]> git.ipfire.org Git - thirdparty/hostap.git/blame - tests/hwsim/test_ap_ft.py
projects / thirdparty / hostap.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
EAP-pwd server: Fix memory leak with salted passwords
[thirdparty/hostap.git] / tests / hwsim / test_ap_ft.py
CommitLineData
cd7f1b9a 1# Fast BSS Transition tests
02a4ac0f 2# Copyright (c) 2013-2019, Jouni Malinen <j@w1.fi>
cd7f1b9a
JM		 3#
4# This software may be distributed under the terms of the BSD license.
5# See README for more details.
6
9fd6804d 7from remotehost import remote_compatible
5b3c40a6
JM		 8import binascii
9import os
cd7f1b9a 10import time
cd7f1b9a 11import logging
c9aa4308 12logger = logging.getLogger()
02a4ac0f 13import signal
c8942286 14import struct
02a4ac0f 15import subprocess
cd7f1b9a
JM		 16
17import hwsim_utils
02a4ac0f 18from hwsim import HWSimRadio
cd7f1b9a 19import hostapd
d7f0bef9 20from tshark import run_tshark
c8942286 21from utils import HwsimSkip, alloc_fail, fail_test, wait_fail_trigger, skip_with_fips, parse_ie
cd7f1b9a 22from wlantest import Wlantest
5b3c40a6 23from test_ap_psk import check_mib, find_wpas_process, read_process_memory, verify_not_present, get_key_locations
392aba4e 24from test_rrm import check_beacon_req
cd7f1b9a
JM		 25
26def ft_base_rsn():
27 params = { "wpa": "2",
28 "wpa_key_mgmt": "FT-PSK",
29 "rsn_pairwise": "CCMP" }
30 return params
31
32def ft_base_mixed():
33 params = { "wpa": "3",
34 "wpa_key_mgmt": "WPA-PSK FT-PSK",
35 "wpa_pairwise": "TKIP",
36 "rsn_pairwise": "CCMP" }
37 return params
38
39def ft_params(rsn=True, ssid=None, passphrase=None):
40 if rsn:
41 params = ft_base_rsn()
42 else:
43 params = ft_base_mixed()
44 if ssid:
45 params["ssid"] = ssid
46 if passphrase:
47 params["wpa_passphrase"] = passphrase
48
49 params["mobility_domain"] = "a1b2"
50 params["r0_key_lifetime"] = "10000"
51 params["pmk_r1_push"] = "1"
52 params["reassociation_deadline"] = "1000"
53 return params
54
d0175d6e 55def ft_params1a(rsn=True, ssid=None, passphrase=None):
cd7f1b9a
JM		 56 params = ft_params(rsn, ssid, passphrase)
57 params['nas_identifier'] = "nas1.w1.fi"
58 params['r1_key_holder'] = "000102030405"
d0175d6e
MB		 59 return params
60
942b52a8 61def ft_params1(rsn=True, ssid=None, passphrase=None, discovery=False):
d0175d6e 62 params = ft_params1a(rsn, ssid, passphrase)
942b52a8
MB		 63 if discovery:
64 params['r0kh'] = "ff:ff:ff:ff:ff:ff * 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f"
65 params['r1kh'] = "00:00:00:00:00:00 00:00:00:00:00:00 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f"
66 else:
67 params['r0kh'] = [ "02:00:00:00:03:00 nas1.w1.fi 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f",
68 "02:00:00:00:04:00 nas2.w1.fi 300102030405060708090a0b0c0d0e0f300102030405060708090a0b0c0d0e0f" ]
69 params['r1kh'] = "02:00:00:00:04:00 00:01:02:03:04:06 200102030405060708090a0b0c0d0e0f200102030405060708090a0b0c0d0e0f"
cd7f1b9a
JM		 70 return params
71
c95dd8e4
JM		 72def ft_params1_old_key(rsn=True, ssid=None, passphrase=None):
73 params = ft_params1a(rsn, ssid, passphrase)
74 params['r0kh'] = [ "02:00:00:00:03:00 nas1.w1.fi 100102030405060708090a0b0c0d0e0f",
75 "02:00:00:00:04:00 nas2.w1.fi 300102030405060708090a0b0c0d0e0f" ]
76 params['r1kh'] = "02:00:00:00:04:00 00:01:02:03:04:06 200102030405060708090a0b0c0d0e0f"
77 return params
78
d0175d6e 79def ft_params2a(rsn=True, ssid=None, passphrase=None):
cd7f1b9a
JM		 80 params = ft_params(rsn, ssid, passphrase)
81 params['nas_identifier'] = "nas2.w1.fi"
82 params['r1_key_holder'] = "000102030406"
d0175d6e
MB		 83 return params
84
942b52a8 85def ft_params2(rsn=True, ssid=None, passphrase=None, discovery=False):
d0175d6e 86 params = ft_params2a(rsn, ssid, passphrase)
942b52a8
MB		 87 if discovery:
88 params['r0kh'] = "ff:ff:ff:ff:ff:ff * 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f"
89 params['r1kh'] = "00:00:00:00:00:00 00:00:00:00:00:00 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f"
90 else:
91 params['r0kh'] = [ "02:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0e0f200102030405060708090a0b0c0d0e0f",
92 "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f" ]
93 params['r1kh'] = "02:00:00:00:03:00 00:01:02:03:04:05 300102030405060708090a0b0c0d0e0f300102030405060708090a0b0c0d0e0f"
cd7f1b9a
JM		 94 return params
95
c95dd8e4
JM		 96def ft_params2_old_key(rsn=True, ssid=None, passphrase=None):
97 params = ft_params2a(rsn, ssid, passphrase)
98 params['r0kh'] = [ "02:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0e0f",
99 "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0e0f" ]
100 params['r1kh'] = "02:00:00:00:03:00 00:01:02:03:04:05 300102030405060708090a0b0c0d0e0f"
101 return params
102
3b808945
JM		 103def ft_params1_r0kh_mismatch(rsn=True, ssid=None, passphrase=None):
104 params = ft_params(rsn, ssid, passphrase)
105 params['nas_identifier'] = "nas1.w1.fi"
106 params['r1_key_holder'] = "000102030405"
9441a227
MB		 107 params['r0kh'] = [ "02:00:00:00:03:00 nas1.w1.fi 100102030405060708090a0b0c0d0e0f100102030405060708090a0b0c0d0e0f",
108 "12:00:00:00:04:00 nas2.w1.fi 300102030405060708090a0b0c0d0e0f300102030405060708090a0b0c0d0e0f" ]
109 params['r1kh'] = "12:00:00:00:04:00 10:01:02:03:04:06 200102030405060708090a0b0c0d0e0f200102030405060708090a0b0c0d0e0f"
3b808945
JM		 110 return params
111
112def ft_params2_incorrect_rrb_key(rsn=True, ssid=None, passphrase=None):
113 params = ft_params(rsn, ssid, passphrase)
114 params['nas_identifier'] = "nas2.w1.fi"
115 params['r1_key_holder'] = "000102030406"
9441a227
MB		 116 params['r0kh'] = [ "02:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0ef1200102030405060708090a0b0c0d0ef1",
117 "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0ef2000102030405060708090a0b0c0d0ef2" ]
118 params['r1kh'] = "02:00:00:00:03:00 00:01:02:03:04:05 300102030405060708090a0b0c0d0ef3300102030405060708090a0b0c0d0ef3"
3b808945
JM		 119 return params
120
121def ft_params2_r0kh_mismatch(rsn=True, ssid=None, passphrase=None):
122 params = ft_params(rsn, ssid, passphrase)
123 params['nas_identifier'] = "nas2.w1.fi"
124 params['r1_key_holder'] = "000102030406"
9441a227
MB		 125 params['r0kh'] = [ "12:00:00:00:03:00 nas1.w1.fi 200102030405060708090a0b0c0d0e0f200102030405060708090a0b0c0d0e0f",
126 "02:00:00:00:04:00 nas2.w1.fi 000102030405060708090a0b0c0d0e0f000102030405060708090a0b0c0d0e0f" ]
127 params['r1kh'] = "12:00:00:00:03:00 10:01:02:03:04:05 300102030405060708090a0b0c0d0e0f300102030405060708090a0b0c0d0e0f"
3b808945
JM		 128 return params
129
7b741a53
JM		 130def run_roams(dev, apdev, hapd0, hapd1, ssid, passphrase, over_ds=False,
131 sae=False, eap=False, fail_test=False, roams=1,
fd7205fa 132 pairwise_cipher="CCMP", group_cipher="TKIP CCMP", ptk_rekey="0",
473e5176 133 test_connectivity=True, eap_identity="gpsk user", conndev=False,
ffcaca68 134 force_initial_conn_to_first_ap=False, sha384=False,
3d5b88b5
JM		 135 group_mgmt=None, ocv=None, sae_password=None,
136 sae_password_id=None):
cd7f1b9a 137 logger.info("Connect to first AP")
473e5176
MB		 138
139 copts = {}
140 copts["proto"] = "WPA2"
141 copts["ieee80211w"] = "1"
142 copts["scan_freq"] = "2412"
143 copts["pairwise"] = pairwise_cipher
144 copts["group"] = group_cipher
145 copts["wpa_ptk_rekey"] = ptk_rekey
ffcaca68
JM		 146 if group_mgmt:
147 copts["group_mgmt"] = group_mgmt
e63d8837
MV		 148 if ocv:
149 copts["ocv"] = ocv
6f62809b 150 if eap:
55b3cda7 151 copts["key_mgmt"] = "FT-EAP-SHA384" if sha384 else "FT-EAP"
473e5176
MB		 152 copts["eap"] = "GPSK"
153 copts["identity"] = eap_identity
154 copts["password"] = "abcdefghijklmnop0123456789abcdef"
6e658cc4 155 else:
6f62809b 156 if sae:
473e5176 157 copts["key_mgmt"] = "FT-SAE"
6f62809b 158 else:
473e5176 159 copts["key_mgmt"] = "FT-PSK"
3d5b88b5
JM		 160 if passphrase:
161 copts["psk"] = passphrase
162 if sae_password:
163 copts["sae_password"] = sae_password
164 if sae_password_id:
165 copts["sae_password_id"] = sae_password_id
473e5176
MB		 166 if force_initial_conn_to_first_ap:
167 copts["bssid"] = apdev[0]['bssid']
168 dev.connect(ssid, **copts)
169
cd7f1b9a
JM		 170 if dev.get_status_field('bssid') == apdev[0]['bssid']:
171 ap1 = apdev[0]
172 ap2 = apdev[1]
a8375c94
JM		 173 hapd1ap = hapd0
174 hapd2ap = hapd1
cd7f1b9a
JM		 175 else:
176 ap1 = apdev[1]
177 ap2 = apdev[0]
a8375c94
JM		 178 hapd1ap = hapd1
179 hapd2ap = hapd0
fd7205fa 180 if test_connectivity:
9c50a6d3
MB		 181 if conndev:
182 hwsim_utils.test_connectivity_iface(dev, hapd1ap, conndev)
183 else:
184 hwsim_utils.test_connectivity(dev, hapd1ap)
cd7f1b9a 185
655bc8bf 186 dev.scan_for_bss(ap2['bssid'], freq="2412")
40602101
JM		 187
188 for i in range(0, roams):
e0382291
MB		 189 # Roaming artificially fast can make data test fail because the key is
190 # set later.
191 time.sleep(0.01)
40602101
JM		 192 logger.info("Roam to the second AP")
193 if over_ds:
194 dev.roam_over_ds(ap2['bssid'], fail_test=fail_test)
195 else:
196 dev.roam(ap2['bssid'], fail_test=fail_test)
197 if fail_test:
198 return
199 if dev.get_status_field('bssid') != ap2['bssid']:
200 raise Exception("Did not connect to correct AP")
fd7205fa 201 if (i == 0 or i == roams - 1) and test_connectivity:
9c50a6d3
MB		 202 if conndev:
203 hwsim_utils.test_connectivity_iface(dev, hapd2ap, conndev)
204 else:
205 hwsim_utils.test_connectivity(dev, hapd2ap)
40602101 206
e0382291
MB		 207 # Roaming artificially fast can make data test fail because the key is
208 # set later.
209 time.sleep(0.01)
40602101
JM		 210 logger.info("Roam back to the first AP")
211 if over_ds:
212 dev.roam_over_ds(ap1['bssid'])
213 else:
214 dev.roam(ap1['bssid'])
215 if dev.get_status_field('bssid') != ap1['bssid']:
216 raise Exception("Did not connect to correct AP")
fd7205fa 217 if (i == 0 or i == roams - 1) and test_connectivity:
9c50a6d3
MB		 218 if conndev:
219 hwsim_utils.test_connectivity_iface(dev, hapd1ap, conndev)
220 else:
221 hwsim_utils.test_connectivity(dev, hapd1ap)
cd7f1b9a
JM		 222
223def test_ap_ft(dev, apdev):
224 """WPA2-PSK-FT AP"""
225 ssid = "test-ft"
226 passphrase="12345678"
227
228 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 229 hapd0 = hostapd.add_ap(apdev[0], params)
cd7f1b9a 230 params = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 231 hapd1 = hostapd.add_ap(apdev[1], params)
cd7f1b9a 232
a8375c94 233 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase)
91bc6c36
JM		 234 if "[WPA2-FT/PSK-CCMP]" not in dev[0].request("SCAN_RESULTS"):
235 raise Exception("Scan results missing RSN element info")
cd7f1b9a 236
c95dd8e4
JM		 237def test_ap_ft_old_key(dev, apdev):
238 """WPA2-PSK-FT AP (old key)"""
239 ssid = "test-ft"
240 passphrase="12345678"
241
242 params = ft_params1_old_key(ssid=ssid, passphrase=passphrase)
243 hapd0 = hostapd.add_ap(apdev[0], params)
244 params = ft_params2_old_key(ssid=ssid, passphrase=passphrase)
245 hapd1 = hostapd.add_ap(apdev[1], params)
246
247 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase)
248
e4612f84
JM		 249def test_ap_ft_multi_akm(dev, apdev):
250 """WPA2-PSK-FT AP with non-FT AKMs enabled"""
251 ssid = "test-ft"
252 passphrase="12345678"
253
254 params = ft_params1(ssid=ssid, passphrase=passphrase)
255 params["wpa_key_mgmt"] = "FT-PSK WPA-PSK WPA-PSK-SHA256"
256 hapd0 = hostapd.add_ap(apdev[0], params)
257 params = ft_params2(ssid=ssid, passphrase=passphrase)
258 params["wpa_key_mgmt"] = "FT-PSK WPA-PSK WPA-PSK-SHA256"
259 hapd1 = hostapd.add_ap(apdev[1], params)
260
261 Wlantest.setup(hapd0)
262 wt = Wlantest()
263 wt.flush()
264 wt.add_passphrase(passphrase)
265
266 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase)
267 if "[WPA2-PSK+FT/PSK+PSK-SHA256-CCMP]" not in dev[0].request("SCAN_RESULTS"):
268 raise Exception("Scan results missing RSN element info")
269 dev[1].connect(ssid, psk=passphrase, scan_freq="2412")
270 dev[2].connect(ssid, psk=passphrase, key_mgmt="WPA-PSK-SHA256",
271 scan_freq="2412")
272
d0175d6e
MB		 273def test_ap_ft_local_key_gen(dev, apdev):
274 """WPA2-PSK-FT AP with local key generation (without pull/push)"""
275 ssid = "test-ft"
276 passphrase="12345678"
277
278 params = ft_params1a(ssid=ssid, passphrase=passphrase)
58be42b2 279 params['ft_psk_generate_local'] = "1"
8344ba12 280 del params['pmk_r1_push']
b098542c 281 hapd0 = hostapd.add_ap(apdev[0], params)
d0175d6e 282 params = ft_params2a(ssid=ssid, passphrase=passphrase)
58be42b2 283 params['ft_psk_generate_local'] = "1"
8344ba12 284 del params['pmk_r1_push']
b098542c 285 hapd1 = hostapd.add_ap(apdev[1], params)
d0175d6e
MB		 286
287 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase)
288 if "[WPA2-FT/PSK-CCMP]" not in dev[0].request("SCAN_RESULTS"):
289 raise Exception("Scan results missing RSN element info")
290
473e5176
MB		 291def test_ap_ft_vlan(dev, apdev):
292 """WPA2-PSK-FT AP with VLAN"""
293 ssid = "test-ft"
294 passphrase="12345678"
295
296 params = ft_params1(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 297 params['dynamic_vlan'] = "1"
298 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 299 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
300
301 params = ft_params2(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 302 params['dynamic_vlan'] = "1"
303 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 304 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
305
306 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, conndev="brvlan1")
307 if "[WPA2-FT/PSK-CCMP]" not in dev[0].request("SCAN_RESULTS"):
308 raise Exception("Scan results missing RSN element info")
309
310def test_ap_ft_vlan_disconnected(dev, apdev):
311 """WPA2-PSK-FT AP with VLAN and local key generation"""
312 ssid = "test-ft"
313 passphrase="12345678"
314
315 params = ft_params1a(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 316 params['dynamic_vlan'] = "1"
317 params['accept_mac_file'] = "hostapd.accept"
318 params['ft_psk_generate_local'] = "1"
473e5176
MB		 319 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
320
321 params = ft_params2a(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 322 params['dynamic_vlan'] = "1"
323 params['accept_mac_file'] = "hostapd.accept"
324 params['ft_psk_generate_local'] = "1"
473e5176
MB		 325 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
326
327 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, conndev="brvlan1")
328 if "[WPA2-FT/PSK-CCMP]" not in dev[0].request("SCAN_RESULTS"):
329 raise Exception("Scan results missing RSN element info")
330
331def test_ap_ft_vlan_2(dev, apdev):
332 """WPA2-PSK-FT AP with VLAN and dest-AP does not have VLAN info locally"""
333 ssid = "test-ft"
334 passphrase="12345678"
335
336 params = ft_params1(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 337 params['dynamic_vlan'] = "1"
338 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 339 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
340
341 params = ft_params2(ssid=ssid, passphrase=passphrase)
58be42b2 342 params['dynamic_vlan'] = "1"
473e5176
MB		 343 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
344
345 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, conndev="brvlan1",
346 force_initial_conn_to_first_ap=True)
347 if "[WPA2-FT/PSK-CCMP]" not in dev[0].request("SCAN_RESULTS"):
348 raise Exception("Scan results missing RSN element info")
349
40602101
JM		 350def test_ap_ft_many(dev, apdev):
351 """WPA2-PSK-FT AP multiple times"""
352 ssid = "test-ft"
353 passphrase="12345678"
354
355 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 356 hapd0 = hostapd.add_ap(apdev[0], params)
40602101 357 params = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 358 hapd1 = hostapd.add_ap(apdev[1], params)
40602101 359
a8375c94 360 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, roams=50)
40602101 361
473e5176
MB		 362def test_ap_ft_many_vlan(dev, apdev):
363 """WPA2-PSK-FT AP with VLAN multiple times"""
364 ssid = "test-ft"
365 passphrase="12345678"
366
367 params = ft_params1(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 368 params['dynamic_vlan'] = "1"
369 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 370 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
371
372 params = ft_params2(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 373 params['dynamic_vlan'] = "1"
374 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 375 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
376
377 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, roams=50,
378 conndev="brvlan1")
379
cd7f1b9a
JM		 380def test_ap_ft_mixed(dev, apdev):
381 """WPA2-PSK-FT mixed-mode AP"""
382 ssid = "test-ft-mixed"
383 passphrase="12345678"
384
385 params = ft_params1(rsn=False, ssid=ssid, passphrase=passphrase)
8b8a1864 386 hapd = hostapd.add_ap(apdev[0], params)
65038313
JM		 387 key_mgmt = hapd.get_config()['key_mgmt']
388 vals = key_mgmt.split(' ')
389 if vals[0] != "WPA-PSK" or vals[1] != "FT-PSK":
390 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
cd7f1b9a 391 params = ft_params2(rsn=False, ssid=ssid, passphrase=passphrase)
8b8a1864 392 hapd1 = hostapd.add_ap(apdev[1], params)
cd7f1b9a 393
a8375c94 394 run_roams(dev[0], apdev, hapd, hapd1, ssid, passphrase)
cd7f1b9a
JM		 395
396def test_ap_ft_pmf(dev, apdev):
397 """WPA2-PSK-FT AP with PMF"""
398 ssid = "test-ft"
399 passphrase="12345678"
400
401 params = ft_params1(ssid=ssid, passphrase=passphrase)
bc6e3288 402 params["ieee80211w"] = "2"
8b8a1864 403 hapd0 = hostapd.add_ap(apdev[0], params)
cd7f1b9a 404 params = ft_params2(ssid=ssid, passphrase=passphrase)
bc6e3288 405 params["ieee80211w"] = "2"
8b8a1864 406 hapd1 = hostapd.add_ap(apdev[1], params)
cd7f1b9a 407
a8375c94 408 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase)
b553eab1 409
ffcaca68
JM		 410def test_ap_ft_pmf_bip_cmac_128(dev, apdev):
411 """WPA2-PSK-FT AP with PMF/BIP-CMAC-128"""
412 run_ap_ft_pmf_bip(dev, apdev, "AES-128-CMAC")
413
414def test_ap_ft_pmf_bip_gmac_128(dev, apdev):
415 """WPA2-PSK-FT AP with PMF/BIP-GMAC-128"""
416 run_ap_ft_pmf_bip(dev, apdev, "BIP-GMAC-128")
417
418def test_ap_ft_pmf_bip_gmac_256(dev, apdev):
419 """WPA2-PSK-FT AP with PMF/BIP-GMAC-256"""
420 run_ap_ft_pmf_bip(dev, apdev, "BIP-GMAC-256")
421
422def test_ap_ft_pmf_bip_cmac_256(dev, apdev):
423 """WPA2-PSK-FT AP with PMF/BIP-CMAC-256"""
424 run_ap_ft_pmf_bip(dev, apdev, "BIP-CMAC-256")
425
426def run_ap_ft_pmf_bip(dev, apdev, cipher):
427 if cipher not in dev[0].get_capability("group_mgmt"):
428 raise HwsimSkip("Cipher %s not supported" % cipher)
429
430 ssid = "test-ft"
431 passphrase="12345678"
432
433 params = ft_params1(ssid=ssid, passphrase=passphrase)
434 params["ieee80211w"] = "2"
435 params["group_mgmt_cipher"] = cipher
436 hapd0 = hostapd.add_ap(apdev[0], params)
437 params = ft_params2(ssid=ssid, passphrase=passphrase)
438 params["ieee80211w"] = "2"
439 params["group_mgmt_cipher"] = cipher
440 hapd1 = hostapd.add_ap(apdev[1], params)
441
442 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase,
443 group_mgmt=cipher)
444
e63d8837
MV		 445def test_ap_ft_ocv(dev, apdev):
446 """WPA2-PSK-FT AP with OCV"""
447 ssid = "test-ft"
448 passphrase="12345678"
449
450 params = ft_params1(ssid=ssid, passphrase=passphrase)
451 params["ieee80211w"] = "2"
452 params["ocv"] = "1"
453 try:
454 hapd0 = hostapd.add_ap(apdev[0], params)
bab493b9 455 except Exception as e:
e63d8837
MV		 456 if "Failed to set hostapd parameter ocv" in str(e):
457 raise HwsimSkip("OCV not supported")
458 raise
459 params = ft_params2(ssid=ssid, passphrase=passphrase)
460 params["ieee80211w"] = "2"
461 params["ocv"] = "1"
462 hapd1 = hostapd.add_ap(apdev[1], params)
463
464 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, ocv="1")
465
b553eab1
JM		 466def test_ap_ft_over_ds(dev, apdev):
467 """WPA2-PSK-FT AP over DS"""
468 ssid = "test-ft"
469 passphrase="12345678"
470
471 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 472 hapd0 = hostapd.add_ap(apdev[0], params)
b553eab1 473 params = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 474 hapd1 = hostapd.add_ap(apdev[1], params)
b553eab1 475
a8375c94 476 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True)
eaf3f9b1
JM		 477 check_mib(dev[0], [ ("dot11RSNAAuthenticationSuiteRequested", "00-0f-ac-4"),
478 ("dot11RSNAAuthenticationSuiteSelected", "00-0f-ac-4") ])
b553eab1 479
02a4ac0f
JM		 480def cleanup_ap_ft_separate_hostapd():
481 subprocess.call(["brctl", "delif", "br0ft", "veth0"],
482 stderr=open('/dev/null', 'w'))
483 subprocess.call(["brctl", "delif", "br1ft", "veth1"],
484 stderr=open('/dev/null', 'w'))
485 subprocess.call(["ip", "link", "del", "veth0"],
486 stderr=open('/dev/null', 'w'))
487 subprocess.call(["ip", "link", "del", "veth1"],
488 stderr=open('/dev/null', 'w'))
489 for ifname in [ 'br0ft', 'br1ft', 'br-ft' ]:
490 subprocess.call(['ip', 'link', 'set', 'dev', ifname, 'down'],
491 stderr=open('/dev/null', 'w'))
492 subprocess.call(['brctl', 'delbr', ifname],
493 stderr=open('/dev/null', 'w'))
494
495def test_ap_ft_separate_hostapd(dev, apdev, params):
496 """WPA2-PSK-FT AP and separate hostapd process"""
497 try:
498 run_ap_ft_separate_hostapd(dev, apdev, params, False)
499 finally:
500 cleanup_ap_ft_separate_hostapd()
501
502def test_ap_ft_over_ds_separate_hostapd(dev, apdev, params):
503 """WPA2-PSK-FT AP over DS and separate hostapd process"""
504 try:
505 run_ap_ft_separate_hostapd(dev, apdev, params, True)
506 finally:
507 cleanup_ap_ft_separate_hostapd()
508
509def run_ap_ft_separate_hostapd(dev, apdev, params, over_ds):
510 ssid = "test-ft"
511 passphrase="12345678"
512 logdir = params['logdir']
513 pidfile = os.path.join(logdir, 'ap_ft_over_ds_separate_hostapd.pid')
514 logfile = os.path.join(logdir, 'ap_ft_over_ds_separate_hostapd.hapd')
515 global_ctrl = '/var/run/hostapd-ft'
516 br_ifname = 'br-ft'
517
518 try:
519 subprocess.check_call(['brctl', 'addbr', br_ifname])
520 subprocess.check_call(['brctl', 'setfd', br_ifname, '0'])
521 subprocess.check_call(['ip', 'link', 'set', 'dev', br_ifname, 'up'])
522
523 subprocess.check_call([ "ip", "link", "add", "veth0", "type", "veth",
524 "peer", "name", "veth0br" ])
525 subprocess.check_call([ "ip", "link", "add", "veth1", "type", "veth",
526 "peer", "name", "veth1br" ])
527 subprocess.check_call(['ip', 'link', 'set', 'dev', 'veth0br', 'up'])
528 subprocess.check_call(['ip', 'link', 'set', 'dev', 'veth1br', 'up'])
529 subprocess.check_call(['brctl', 'addif', br_ifname, 'veth0br'])
530 subprocess.check_call(['brctl', 'addif', br_ifname, 'veth1br'])
531
532 subprocess.check_call(['brctl', 'addbr', 'br0ft'])
533 subprocess.check_call(['brctl', 'setfd', 'br0ft', '0'])
534 subprocess.check_call(['ip', 'link', 'set', 'dev', 'br0ft', 'up'])
535 subprocess.check_call(['ip', 'link', 'set', 'dev', 'veth0', 'up'])
536 subprocess.check_call(['brctl', 'addif', 'br0ft', 'veth0'])
537 subprocess.check_call(['brctl', 'addbr', 'br1ft'])
538 subprocess.check_call(['brctl', 'setfd', 'br1ft', '0'])
539 subprocess.check_call(['ip', 'link', 'set', 'dev', 'br1ft', 'up'])
540 subprocess.check_call(['ip', 'link', 'set', 'dev', 'veth1', 'up'])
541 subprocess.check_call(['brctl', 'addif', 'br1ft', 'veth1'])
542 except subprocess.CalledProcessError:
543 raise HwsimSkip("Bridge or veth not supported (kernel CONFIG_VETH)")
544
545 with HWSimRadio() as (radio, iface):
546 prg = os.path.join(logdir, 'alt-hostapd/hostapd/hostapd')
547 if not os.path.exists(prg):
548 prg = '../../hostapd/hostapd'
549 cmd = [ prg, '-B', '-ddKt',
550 '-P', pidfile, '-f', logfile, '-g', global_ctrl ]
551 subprocess.check_call(cmd)
552
553 hglobal = hostapd.HostapdGlobal(global_ctrl_override=global_ctrl)
554 apdev_ft = { 'ifname': iface }
555 apdev2 = [ apdev_ft, apdev[1] ]
556
557 params = ft_params1(ssid=ssid, passphrase=passphrase)
558 params["r0kh"] = "ff:ff:ff:ff:ff:ff * 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
559 params["r1kh"] = "00:00:00:00:00:00 00:00:00:00:00:00 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
560 params['bridge'] = 'br0ft'
561 hapd0 = hostapd.add_ap(apdev2[0], params,
562 global_ctrl_override=global_ctrl)
563 apdev2[0]['bssid'] = hapd0.own_addr()
564 params = ft_params2(ssid=ssid, passphrase=passphrase)
565 params["r0kh"] = "ff:ff:ff:ff:ff:ff * 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
566 params["r1kh"] = "00:00:00:00:00:00 00:00:00:00:00:00 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
567 params['bridge'] = 'br1ft'
568 hapd1 = hostapd.add_ap(apdev2[1], params)
569
570 run_roams(dev[0], apdev2, hapd0, hapd1, ssid, passphrase,
571 over_ds=over_ds, test_connectivity=False)
572
573 hglobal.terminate()
574
575 if os.path.exists(pidfile):
576 with open(pidfile, 'r') as f:
577 pid = int(f.read())
578 f.close()
579 os.kill(pid, signal.SIGTERM)
580
e63d8837
MV		 581def test_ap_ft_over_ds_ocv(dev, apdev):
582 """WPA2-PSK-FT AP over DS"""
583 ssid = "test-ft"
584 passphrase="12345678"
585
586 params = ft_params1(ssid=ssid, passphrase=passphrase)
587 params["ieee80211w"] = "2"
588 params["ocv"] = "1"
589 try:
590 hapd0 = hostapd.add_ap(apdev[0], params)
bab493b9 591 except Exception as e:
e63d8837
MV		 592 if "Failed to set hostapd parameter ocv" in str(e):
593 raise HwsimSkip("OCV not supported")
594 raise
595 params = ft_params2(ssid=ssid, passphrase=passphrase)
596 params["ieee80211w"] = "2"
597 params["ocv"] = "1"
598 hapd1 = hostapd.add_ap(apdev[1], params)
599
600 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
601 ocv="1")
602
55139acb
JM		 603def test_ap_ft_over_ds_disabled(dev, apdev):
604 """WPA2-PSK-FT AP over DS disabled"""
605 ssid = "test-ft"
606 passphrase="12345678"
607
608 params = ft_params1(ssid=ssid, passphrase=passphrase)
609 params['ft_over_ds'] = '0'
610 hapd0 = hostapd.add_ap(apdev[0], params)
611 params = ft_params2(ssid=ssid, passphrase=passphrase)
612 params['ft_over_ds'] = '0'
613 hapd1 = hostapd.add_ap(apdev[1], params)
614
615 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
616 fail_test=True)
617
473e5176
MB		 618def test_ap_ft_vlan_over_ds(dev, apdev):
619 """WPA2-PSK-FT AP over DS with VLAN"""
620 ssid = "test-ft"
621 passphrase="12345678"
622
623 params = ft_params1(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 624 params['dynamic_vlan'] = "1"
625 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 626 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
627 params = ft_params2(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 628 params['dynamic_vlan'] = "1"
629 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 630 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
631
632 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
633 conndev="brvlan1")
634 check_mib(dev[0], [ ("dot11RSNAAuthenticationSuiteRequested", "00-0f-ac-4"),
635 ("dot11RSNAAuthenticationSuiteSelected", "00-0f-ac-4") ])
636
40602101
JM		 637def test_ap_ft_over_ds_many(dev, apdev):
638 """WPA2-PSK-FT AP over DS multiple times"""
639 ssid = "test-ft"
640 passphrase="12345678"
641
642 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 643 hapd0 = hostapd.add_ap(apdev[0], params)
40602101 644 params = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 645 hapd1 = hostapd.add_ap(apdev[1], params)
40602101 646
a8375c94
JM		 647 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
648 roams=50)
40602101 649
473e5176
MB		 650def test_ap_ft_vlan_over_ds_many(dev, apdev):
651 """WPA2-PSK-FT AP over DS with VLAN multiple times"""
652 ssid = "test-ft"
653 passphrase="12345678"
654
655 params = ft_params1(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 656 params['dynamic_vlan'] = "1"
657 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 658 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
659 params = ft_params2(ssid=ssid, passphrase=passphrase)
58be42b2
JM		 660 params['dynamic_vlan'] = "1"
661 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 662 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
663
664 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
665 roams=50, conndev="brvlan1")
666
9fd6804d 667@remote_compatible
c337d07a
JM		 668def test_ap_ft_over_ds_unknown_target(dev, apdev):
669 """WPA2-PSK-FT AP"""
670 ssid = "test-ft"
671 passphrase="12345678"
672
673 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 674 hapd0 = hostapd.add_ap(apdev[0], params)
c337d07a
JM		 675
676 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
677 scan_freq="2412")
678 dev[0].roam_over_ds("02:11:22:33:44:55", fail_test=True)
679
9fd6804d 680@remote_compatible
211bb7c5
JM		 681def test_ap_ft_over_ds_unexpected(dev, apdev):
682 """WPA2-PSK-FT AP over DS and unexpected response"""
683 ssid = "test-ft"
684 passphrase="12345678"
685
686 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 687 hapd0 = hostapd.add_ap(apdev[0], params)
211bb7c5 688 params = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 689 hapd1 = hostapd.add_ap(apdev[1], params)
211bb7c5
JM		 690
691 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
692 scan_freq="2412")
693 if dev[0].get_status_field('bssid') == apdev[0]['bssid']:
694 ap1 = apdev[0]
695 ap2 = apdev[1]
696 hapd1ap = hapd0
697 hapd2ap = hapd1
698 else:
699 ap1 = apdev[1]
700 ap2 = apdev[0]
701 hapd1ap = hapd1
702 hapd2ap = hapd0
703
704 addr = dev[0].own_addr()
705 hapd1ap.set("ext_mgmt_frame_handling", "1")
706 logger.info("Foreign STA address")
707 msg = {}
708 msg['fc'] = 13 << 4
709 msg['da'] = addr
710 msg['sa'] = ap1['bssid']
711 msg['bssid'] = ap1['bssid']
712 msg['payload'] = binascii.unhexlify("06021122334455660102030405060000")
713 hapd1ap.mgmt_tx(msg)
714
715 logger.info("No over-the-DS in progress")
716 msg['payload'] = binascii.unhexlify("0602" + addr.replace(':', '') + "0102030405060000")
717 hapd1ap.mgmt_tx(msg)
718
719 logger.info("Non-zero status code")
720 msg['payload'] = binascii.unhexlify("0602" + addr.replace(':', '') + "0102030405060100")
721 hapd1ap.mgmt_tx(msg)
722
723 hapd1ap.dump_monitor()
724
725 dev[0].scan_for_bss(ap2['bssid'], freq="2412")
726 if "OK" not in dev[0].request("FT_DS " + ap2['bssid']):
727 raise Exception("FT_DS failed")
728
729 req = hapd1ap.mgmt_rx()
730
731 logger.info("Foreign Target AP")
732 msg['payload'] = binascii.unhexlify("0602" + addr.replace(':', '') + "0102030405060000")
733 hapd1ap.mgmt_tx(msg)
734
735 addrs = addr.replace(':', '') + ap2['bssid'].replace(':', '')
736
737 logger.info("No IEs")
738 msg['payload'] = binascii.unhexlify("0602" + addrs + "0000")
739 hapd1ap.mgmt_tx(msg)
740
741 logger.info("Invalid IEs (trigger parsing failure)")
742 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003700")
743 hapd1ap.mgmt_tx(msg)
744
745 logger.info("Too short MDIE")
746 msg['payload'] = binascii.unhexlify("0602" + addrs + "000036021122")
747 hapd1ap.mgmt_tx(msg)
748
749 logger.info("Mobility domain mismatch")
750 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603112201")
751 hapd1ap.mgmt_tx(msg)
752
753 logger.info("No FTIE")
754 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b201")
755 hapd1ap.mgmt_tx(msg)
756
757 logger.info("FTIE SNonce mismatch")
758 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b201375e0000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + "1000000000000000000000000000000000000000000000000000000000000001" + "030a6e6173322e77312e6669")
759 hapd1ap.mgmt_tx(msg)
760
761 logger.info("No R0KH-ID subelem in FTIE")
7ab74770 762 snonce = binascii.hexlify(req['payload'][111:111+32]).decode()
211bb7c5
JM		 763 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b20137520000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce)
764 hapd1ap.mgmt_tx(msg)
765
766 logger.info("No R0KH-ID subelem mismatch in FTIE")
7ab74770 767 snonce = binascii.hexlify(req['payload'][111:111+32]).decode()
211bb7c5
JM		 768 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b201375e0000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce + "030a11223344556677889900")
769 hapd1ap.mgmt_tx(msg)
770
771 logger.info("No R1KH-ID subelem in FTIE")
7ab74770 772 r0khid = binascii.hexlify(req['payload'][145:145+10]).decode()
211bb7c5
JM		 773 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b201375e0000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce + "030a" + r0khid)
774 hapd1ap.mgmt_tx(msg)
775
776 logger.info("No RSNE")
7ab74770 777 r0khid = binascii.hexlify(req['payload'][145:145+10]).decode()
211bb7c5
JM		 778 msg['payload'] = binascii.unhexlify("0602" + addrs + "00003603a1b20137660000" + "00000000000000000000000000000000" + "0000000000000000000000000000000000000000000000000000000000000000" + snonce + "030a" + r0khid + "0106000102030405")
779 hapd1ap.mgmt_tx(msg)
780
b553eab1
JM		 781def test_ap_ft_pmf_over_ds(dev, apdev):
782 """WPA2-PSK-FT AP over DS with PMF"""
783 ssid = "test-ft"
784 passphrase="12345678"
785
786 params = ft_params1(ssid=ssid, passphrase=passphrase)
bc6e3288 787 params["ieee80211w"] = "2"
8b8a1864 788 hapd0 = hostapd.add_ap(apdev[0], params)
b553eab1 789 params = ft_params2(ssid=ssid, passphrase=passphrase)
bc6e3288 790 params["ieee80211w"] = "2"
8b8a1864 791 hapd1 = hostapd.add_ap(apdev[1], params)
b553eab1 792
ffcaca68
JM		 793def test_ap_ft_pmf_bip_cmac_128_over_ds(dev, apdev):
794 """WPA2-PSK-FT AP over DS with PMF/BIP-CMAC-128"""
795 run_ap_ft_pmf_bip_over_ds(dev, apdev, "AES-128-CMAC")
796
797def test_ap_ft_pmf_bip_gmac_128_over_ds(dev, apdev):
798 """WPA2-PSK-FT AP over DS with PMF/BIP-GMAC-128"""
799 run_ap_ft_pmf_bip_over_ds(dev, apdev, "BIP-GMAC-128")
800
801def test_ap_ft_pmf_bip_gmac_256_over_ds(dev, apdev):
802 """WPA2-PSK-FT AP over DS with PMF/BIP-GMAC-256"""
803 run_ap_ft_pmf_bip_over_ds(dev, apdev, "BIP-GMAC-256")
804
805def test_ap_ft_pmf_bip_cmac_256_over_ds(dev, apdev):
806 """WPA2-PSK-FT AP over DS with PMF/BIP-CMAC-256"""
807 run_ap_ft_pmf_bip_over_ds(dev, apdev, "BIP-CMAC-256")
808
809def run_ap_ft_pmf_bip_over_ds(dev, apdev, cipher):
810 if cipher not in dev[0].get_capability("group_mgmt"):
811 raise HwsimSkip("Cipher %s not supported" % cipher)
812
813 ssid = "test-ft"
814 passphrase="12345678"
815
816 params = ft_params1(ssid=ssid, passphrase=passphrase)
817 params["ieee80211w"] = "2"
818 params["group_mgmt_cipher"] = cipher
819 hapd0 = hostapd.add_ap(apdev[0], params)
820 params = ft_params2(ssid=ssid, passphrase=passphrase)
821 params["ieee80211w"] = "2"
822 params["group_mgmt_cipher"] = cipher
823 hapd1 = hostapd.add_ap(apdev[1], params)
824
825 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
826 group_mgmt=cipher)
6e658cc4 827
aaba98d3
JM		 828def test_ap_ft_over_ds_pull(dev, apdev):
829 """WPA2-PSK-FT AP over DS (pull PMK)"""
830 ssid = "test-ft"
831 passphrase="12345678"
832
833 params = ft_params1(ssid=ssid, passphrase=passphrase)
834 params["pmk_r1_push"] = "0"
8b8a1864 835 hapd0 = hostapd.add_ap(apdev[0], params)
aaba98d3
JM		 836 params = ft_params2(ssid=ssid, passphrase=passphrase)
837 params["pmk_r1_push"] = "0"
8b8a1864 838 hapd1 = hostapd.add_ap(apdev[1], params)
aaba98d3 839
a8375c94 840 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True)
aaba98d3 841
c95dd8e4
JM		 842def test_ap_ft_over_ds_pull_old_key(dev, apdev):
843 """WPA2-PSK-FT AP over DS (pull PMK; old key)"""
844 ssid = "test-ft"
845 passphrase="12345678"
846
847 params = ft_params1_old_key(ssid=ssid, passphrase=passphrase)
848 params["pmk_r1_push"] = "0"
849 hapd0 = hostapd.add_ap(apdev[0], params)
850 params = ft_params2_old_key(ssid=ssid, passphrase=passphrase)
851 params["pmk_r1_push"] = "0"
852 hapd1 = hostapd.add_ap(apdev[1], params)
853
854 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True)
855
473e5176
MB		 856def test_ap_ft_over_ds_pull_vlan(dev, apdev):
857 """WPA2-PSK-FT AP over DS (pull PMK) with VLAN"""
858 ssid = "test-ft"
859 passphrase="12345678"
860
861 params = ft_params1(ssid=ssid, passphrase=passphrase)
862 params["pmk_r1_push"] = "0"
58be42b2
JM		 863 params['dynamic_vlan'] = "1"
864 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 865 hapd0 = hostapd.add_ap(apdev[0]['ifname'], params)
866 params = ft_params2(ssid=ssid, passphrase=passphrase)
867 params["pmk_r1_push"] = "0"
58be42b2
JM		 868 params['dynamic_vlan'] = "1"
869 params['accept_mac_file'] = "hostapd.accept"
473e5176
MB		 870 hapd1 = hostapd.add_ap(apdev[1]['ifname'], params)
871
872 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
873 conndev="brvlan1")
874
6e658cc4
JM		 875def test_ap_ft_sae(dev, apdev):
876 """WPA2-PSK-FT-SAE AP"""
b9749b6a
JM		 877 if "SAE" not in dev[0].get_capability("auth_alg"):
878 raise HwsimSkip("SAE not supported")
6e658cc4
JM		 879 ssid = "test-ft"
880 passphrase="12345678"
881
882 params = ft_params1(ssid=ssid, passphrase=passphrase)
883 params['wpa_key_mgmt'] = "FT-SAE"
8b8a1864 884 hapd0 = hostapd.add_ap(apdev[0], params)
6e658cc4
JM		 885 params = ft_params2(ssid=ssid, passphrase=passphrase)
886 params['wpa_key_mgmt'] = "FT-SAE"
8b8a1864 887 hapd = hostapd.add_ap(apdev[1], params)
65038313
JM		 888 key_mgmt = hapd.get_config()['key_mgmt']
889 if key_mgmt.split(' ')[0] != "FT-SAE":
890 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
6e658cc4 891
17ffdf39 892 dev[0].request("SET sae_groups ")
a8375c94 893 run_roams(dev[0], apdev, hapd0, hapd, ssid, passphrase, sae=True)
6e658cc4
JM		 894
895def test_ap_ft_sae_over_ds(dev, apdev):
896 """WPA2-PSK-FT-SAE AP over DS"""
b9749b6a
JM		 897 if "SAE" not in dev[0].get_capability("auth_alg"):
898 raise HwsimSkip("SAE not supported")
6e658cc4
JM		 899 ssid = "test-ft"
900 passphrase="12345678"
901
902 params = ft_params1(ssid=ssid, passphrase=passphrase)
903 params['wpa_key_mgmt'] = "FT-SAE"
8b8a1864 904 hapd0 = hostapd.add_ap(apdev[0], params)
6e658cc4
JM		 905 params = ft_params2(ssid=ssid, passphrase=passphrase)
906 params['wpa_key_mgmt'] = "FT-SAE"
8b8a1864 907 hapd1 = hostapd.add_ap(apdev[1], params)
6e658cc4 908
17ffdf39 909 dev[0].request("SET sae_groups ")
a8375c94
JM		 910 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, sae=True,
911 over_ds=True)
6f62809b 912
3d5b88b5
JM		 913def test_ap_ft_sae_pw_id(dev, apdev):
914 """FT-SAE with Password Identifier"""
915 if "SAE" not in dev[0].get_capability("auth_alg"):
916 raise HwsimSkip("SAE not supported")
917 ssid = "test-ft"
918
919 params = ft_params1(ssid=ssid)
920 params["ieee80211w"] = "2"
921 params['wpa_key_mgmt'] = "FT-SAE"
922 params['sae_password'] = 'secret|id=pwid'
923 hapd0 = hostapd.add_ap(apdev[0], params)
924 params = ft_params2(ssid=ssid)
925 params["ieee80211w"] = "2"
926 params['wpa_key_mgmt'] = "FT-SAE"
927 params['sae_password'] = 'secret|id=pwid'
928 hapd = hostapd.add_ap(apdev[1], params)
929
930 dev[0].request("SET sae_groups ")
931 run_roams(dev[0], apdev, hapd0, hapd, ssid, passphrase=None, sae=True,
932 sae_password="secret", sae_password_id="pwid")
933
d269740a
MB		 934def generic_ap_ft_eap(dev, apdev, vlan=False, cui=False, over_ds=False,
935 discovery=False, roams=1):
6f62809b
JM		 936 ssid = "test-ft"
937 passphrase="12345678"
9c50a6d3
MB		 938 if vlan:
939 identity="gpsk-vlan1"
940 conndev="brvlan1"
d269740a
MB		 941 elif cui:
942 identity="gpsk-cui"
943 conndev=False
9c50a6d3
MB		 944 else:
945 identity="gpsk user"
946 conndev=False
6f62809b
JM		 947
948 radius = hostapd.radius_params()
942b52a8 949 params = ft_params1(ssid=ssid, passphrase=passphrase, discovery=discovery)
6f62809b
JM		 950 params['wpa_key_mgmt'] = "FT-EAP"
951 params["ieee8021x"] = "1"
9c50a6d3
MB		 952 if vlan:
953 params["dynamic_vlan"] = "1"
35d8c254 954 params = dict(list(radius.items()) + list(params.items()))
8b8a1864 955 hapd = hostapd.add_ap(apdev[0], params)
65038313
JM		 956 key_mgmt = hapd.get_config()['key_mgmt']
957 if key_mgmt.split(' ')[0] != "FT-EAP":
958 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
942b52a8 959 params = ft_params2(ssid=ssid, passphrase=passphrase, discovery=discovery)
6f62809b
JM		 960 params['wpa_key_mgmt'] = "FT-EAP"
961 params["ieee8021x"] = "1"
9c50a6d3
MB		 962 if vlan:
963 params["dynamic_vlan"] = "1"
35d8c254 964 params = dict(list(radius.items()) + list(params.items()))
8b8a1864 965 hapd1 = hostapd.add_ap(apdev[1], params)
6f62809b 966
942b52a8 967 run_roams(dev[0], apdev, hapd, hapd1, ssid, passphrase, eap=True,
9c50a6d3
MB		 968 over_ds=over_ds, roams=roams, eap_identity=identity,
969 conndev=conndev)
91bc6c36
JM		 970 if "[WPA2-FT/EAP-CCMP]" not in dev[0].request("SCAN_RESULTS"):
971 raise Exception("Scan results missing RSN element info")
eaf3f9b1
JM		 972 check_mib(dev[0], [ ("dot11RSNAAuthenticationSuiteRequested", "00-0f-ac-3"),
973 ("dot11RSNAAuthenticationSuiteSelected", "00-0f-ac-3") ])
aaba98d3 974
4013d688
JM		 975 # Verify EAPOL reauthentication after FT protocol
976 if dev[0].get_status_field('bssid') == apdev[0]['bssid']:
977 ap = hapd
978 else:
979 ap = hapd1
980 ap.request("EAPOL_REAUTH " + dev[0].own_addr())
981 ev = dev[0].wait_event(["CTRL-EVENT-EAP-STARTED"], timeout=5)
982 if ev is None:
983 raise Exception("EAP authentication did not start")
984 ev = dev[0].wait_event(["CTRL-EVENT-EAP-SUCCESS"], timeout=5)
985 if ev is None:
986 raise Exception("EAP authentication did not succeed")
987 time.sleep(0.1)
9c50a6d3
MB		 988 if conndev:
989 hwsim_utils.test_connectivity_iface(dev[0], ap, conndev)
990 else:
991 hwsim_utils.test_connectivity(dev[0], ap)
4013d688 992
942b52a8
MB		 993def test_ap_ft_eap(dev, apdev):
994 """WPA2-EAP-FT AP"""
995 generic_ap_ft_eap(dev, apdev)
996
d269740a
MB		 997def test_ap_ft_eap_cui(dev, apdev):
998 """WPA2-EAP-FT AP with CUI"""
999 generic_ap_ft_eap(dev, apdev, vlan=False, cui=True)
1000
9c50a6d3
MB		 1001def test_ap_ft_eap_vlan(dev, apdev):
1002 """WPA2-EAP-FT AP with VLAN"""
1003 generic_ap_ft_eap(dev, apdev, vlan=True)
1004
1005def test_ap_ft_eap_vlan_multi(dev, apdev):
1006 """WPA2-EAP-FT AP with VLAN"""
1007 generic_ap_ft_eap(dev, apdev, vlan=True, roams=50)
1008
942b52a8
MB		 1009def test_ap_ft_eap_over_ds(dev, apdev):
1010 """WPA2-EAP-FT AP using over-the-DS"""
1011 generic_ap_ft_eap(dev, apdev, over_ds=True)
1012
1013def test_ap_ft_eap_dis(dev, apdev):
1014 """WPA2-EAP-FT AP with AP discovery"""
1015 generic_ap_ft_eap(dev, apdev, discovery=True)
1016
1017def test_ap_ft_eap_dis_over_ds(dev, apdev):
1018 """WPA2-EAP-FT AP with AP discovery and over-the-DS"""
1019 generic_ap_ft_eap(dev, apdev, over_ds=True, discovery=True)
1020
9c50a6d3
MB		 1021def test_ap_ft_eap_vlan(dev, apdev):
1022 """WPA2-EAP-FT AP with VLAN"""
1023 generic_ap_ft_eap(dev, apdev, vlan=True)
1024
1025def test_ap_ft_eap_vlan_multi(dev, apdev):
1026 """WPA2-EAP-FT AP with VLAN"""
1027 generic_ap_ft_eap(dev, apdev, vlan=True, roams=50)
1028
1029def test_ap_ft_eap_vlan_over_ds(dev, apdev):
1030 """WPA2-EAP-FT AP with VLAN + over_ds"""
1031 generic_ap_ft_eap(dev, apdev, vlan=True, over_ds=True)
1032
1033def test_ap_ft_eap_vlan_over_ds_multi(dev, apdev):
1034 """WPA2-EAP-FT AP with VLAN + over_ds"""
1035 generic_ap_ft_eap(dev, apdev, vlan=True, over_ds=True, roams=50)
1036
1037def generic_ap_ft_eap_pull(dev, apdev, vlan=False):
aaba98d3
JM		 1038 """WPA2-EAP-FT AP (pull PMK)"""
1039 ssid = "test-ft"
1040 passphrase="12345678"
9c50a6d3
MB		 1041 if vlan:
1042 identity="gpsk-vlan1"
1043 conndev="brvlan1"
1044 else:
1045 identity="gpsk user"
1046 conndev=False
aaba98d3
JM		 1047
1048 radius = hostapd.radius_params()
1049 params = ft_params1(ssid=ssid, passphrase=passphrase)
1050 params['wpa_key_mgmt'] = "FT-EAP"
1051 params["ieee8021x"] = "1"
1052 params["pmk_r1_push"] = "0"
9c50a6d3
MB		 1053 if vlan:
1054 params["dynamic_vlan"] = "1"
35d8c254 1055 params = dict(list(radius.items()) + list(params.items()))
8b8a1864 1056 hapd = hostapd.add_ap(apdev[0], params)
aaba98d3
JM		 1057 key_mgmt = hapd.get_config()['key_mgmt']
1058 if key_mgmt.split(' ')[0] != "FT-EAP":
1059 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
1060 params = ft_params2(ssid=ssid, passphrase=passphrase)
1061 params['wpa_key_mgmt'] = "FT-EAP"
1062 params["ieee8021x"] = "1"
1063 params["pmk_r1_push"] = "0"
9c50a6d3
MB		 1064 if vlan:
1065 params["dynamic_vlan"] = "1"
35d8c254 1066 params = dict(list(radius.items()) + list(params.items()))
8b8a1864 1067 hapd1 = hostapd.add_ap(apdev[1], params)
aaba98d3 1068
9c50a6d3
MB		 1069 run_roams(dev[0], apdev, hapd, hapd1, ssid, passphrase, eap=True,
1070 eap_identity=identity, conndev=conndev)
1071
1072def test_ap_ft_eap_pull(dev, apdev):
1073 """WPA2-EAP-FT AP (pull PMK)"""
1074 generic_ap_ft_eap_pull(dev, apdev)
1075
1076def test_ap_ft_eap_pull_vlan(dev, apdev):
1077 generic_ap_ft_eap_pull(dev, apdev, vlan=True)
3b808945 1078
f81c1411
JM		 1079def test_ap_ft_eap_pull_wildcard(dev, apdev):
1080 """WPA2-EAP-FT AP (pull PMK) - wildcard R0KH/R1KH"""
1081 ssid = "test-ft"
1082 passphrase="12345678"
1083
1084 radius = hostapd.radius_params()
1085 params = ft_params1(ssid=ssid, passphrase=passphrase, discovery=True)
1086 params['wpa_key_mgmt'] = "WPA-EAP FT-EAP"
1087 params["ieee8021x"] = "1"
1088 params["pmk_r1_push"] = "0"
1089 params["r0kh"] = "ff:ff:ff:ff:ff:ff * 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
1090 params["r1kh"] = "00:00:00:00:00:00 00:00:00:00:00:00 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
1091 params["ft_psk_generate_local"] = "1"
1092 params["eap_server"] = "0"
35d8c254 1093 params = dict(list(radius.items()) + list(params.items()))
f81c1411
JM		 1094 hapd = hostapd.add_ap(apdev[0], params)
1095 params = ft_params2(ssid=ssid, passphrase=passphrase, discovery=True)
1096 params['wpa_key_mgmt'] = "WPA-EAP FT-EAP"
1097 params["ieee8021x"] = "1"
1098 params["pmk_r1_push"] = "0"
1099 params["r0kh"] = "ff:ff:ff:ff:ff:ff * 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
1100 params["r1kh"] = "00:00:00:00:00:00 00:00:00:00:00:00 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
1101 params["ft_psk_generate_local"] = "1"
1102 params["eap_server"] = "0"
35d8c254 1103 params = dict(list(radius.items()) + list(params.items()))
f81c1411
JM		 1104 hapd1 = hostapd.add_ap(apdev[1], params)
1105
1106 run_roams(dev[0], apdev, hapd, hapd1, ssid, passphrase, eap=True)
1107
9fd6804d 1108@remote_compatible
3b808945
JM		 1109def test_ap_ft_mismatching_rrb_key_push(dev, apdev):
1110 """WPA2-PSK-FT AP over DS with mismatching RRB key (push)"""
1111 ssid = "test-ft"
1112 passphrase="12345678"
1113
1114 params = ft_params1(ssid=ssid, passphrase=passphrase)
bc6e3288 1115 params["ieee80211w"] = "2"
8b8a1864 1116 hapd0 = hostapd.add_ap(apdev[0], params)
3b808945 1117 params = ft_params2_incorrect_rrb_key(ssid=ssid, passphrase=passphrase)
bc6e3288 1118 params["ieee80211w"] = "2"
8b8a1864 1119 hapd1 = hostapd.add_ap(apdev[1], params)
3b808945 1120
a8375c94
JM		 1121 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1122 fail_test=True)
3b808945 1123
9fd6804d 1124@remote_compatible
3b808945
JM		 1125def test_ap_ft_mismatching_rrb_key_pull(dev, apdev):
1126 """WPA2-PSK-FT AP over DS with mismatching RRB key (pull)"""
1127 ssid = "test-ft"
1128 passphrase="12345678"
1129
1130 params = ft_params1(ssid=ssid, passphrase=passphrase)
1131 params["pmk_r1_push"] = "0"
8b8a1864 1132 hapd0 = hostapd.add_ap(apdev[0], params)
3b808945
JM		 1133 params = ft_params2_incorrect_rrb_key(ssid=ssid, passphrase=passphrase)
1134 params["pmk_r1_push"] = "0"
8b8a1864 1135 hapd1 = hostapd.add_ap(apdev[1], params)
3b808945 1136
a8375c94
JM		 1137 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1138 fail_test=True)
3b808945 1139
9fd6804d 1140@remote_compatible
ae14a2e2
JM		 1141def test_ap_ft_mismatching_r0kh_id_pull(dev, apdev):
1142 """WPA2-PSK-FT AP over DS with mismatching R0KH-ID (pull)"""
1143 ssid = "test-ft"
1144 passphrase="12345678"
1145
1146 params = ft_params1(ssid=ssid, passphrase=passphrase)
1147 params["pmk_r1_push"] = "0"
1148 params["nas_identifier"] = "nas0.w1.fi"
8b8a1864 1149 hostapd.add_ap(apdev[0], params)
2f816c21
JM		 1150 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1151 scan_freq="2412")
ae14a2e2
JM		 1152
1153 params = ft_params2(ssid=ssid, passphrase=passphrase)
1154 params["pmk_r1_push"] = "0"
8b8a1864 1155 hostapd.add_ap(apdev[1], params)
ae14a2e2
JM		 1156
1157 dev[0].scan_for_bss(apdev[1]['bssid'], freq="2412")
1158 dev[0].roam_over_ds(apdev[1]['bssid'], fail_test=True)
1159
9fd6804d 1160@remote_compatible
3b808945
JM		 1161def test_ap_ft_mismatching_rrb_r0kh_push(dev, apdev):
1162 """WPA2-PSK-FT AP over DS with mismatching R0KH key (push)"""
1163 ssid = "test-ft"
1164 passphrase="12345678"
1165
1166 params = ft_params1(ssid=ssid, passphrase=passphrase)
bc6e3288 1167 params["ieee80211w"] = "2"
8b8a1864 1168 hapd0 = hostapd.add_ap(apdev[0], params)
3b808945 1169 params = ft_params2_r0kh_mismatch(ssid=ssid, passphrase=passphrase)
bc6e3288 1170 params["ieee80211w"] = "2"
8b8a1864 1171 hapd1 = hostapd.add_ap(apdev[1], params)
3b808945 1172
a8375c94
JM		 1173 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1174 fail_test=True)
3b808945 1175
9fd6804d 1176@remote_compatible
3b808945
JM		 1177def test_ap_ft_mismatching_rrb_r0kh_pull(dev, apdev):
1178 """WPA2-PSK-FT AP over DS with mismatching R0KH key (pull)"""
1179 ssid = "test-ft"
1180 passphrase="12345678"
1181
1182 params = ft_params1_r0kh_mismatch(ssid=ssid, passphrase=passphrase)
1183 params["pmk_r1_push"] = "0"
8b8a1864 1184 hapd0 = hostapd.add_ap(apdev[0], params)
3b808945
JM		 1185 params = ft_params2(ssid=ssid, passphrase=passphrase)
1186 params["pmk_r1_push"] = "0"
8b8a1864 1187 hapd1 = hostapd.add_ap(apdev[1], params)
3b808945 1188
a8375c94
JM		 1189 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1190 fail_test=True)
c6b6e105 1191
150948e6
MB		 1192def test_ap_ft_mismatching_rrb_key_push_eap(dev, apdev):
1193 """WPA2-EAP-FT AP over DS with mismatching RRB key (push)"""
1194 ssid = "test-ft"
1195 passphrase="12345678"
1196
1197 radius = hostapd.radius_params()
1198 params = ft_params1(ssid=ssid, passphrase=passphrase)
58be42b2 1199 params["ieee80211w"] = "2"
150948e6
MB		 1200 params['wpa_key_mgmt'] = "FT-EAP"
1201 params["ieee8021x"] = "1"
35d8c254 1202 params = dict(list(radius.items()) + list(params.items()))
b098542c 1203 hapd0 = hostapd.add_ap(apdev[0], params)
150948e6 1204 params = ft_params2_incorrect_rrb_key(ssid=ssid, passphrase=passphrase)
58be42b2 1205 params["ieee80211w"] = "2"
150948e6
MB		 1206 params['wpa_key_mgmt'] = "FT-EAP"
1207 params["ieee8021x"] = "1"
35d8c254 1208 params = dict(list(radius.items()) + list(params.items()))
b098542c 1209 hapd1 = hostapd.add_ap(apdev[1], params)
150948e6
MB		 1210
1211 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1212 fail_test=True, eap=True)
1213
1214def test_ap_ft_mismatching_rrb_key_pull_eap(dev, apdev):
1215 """WPA2-EAP-FT AP over DS with mismatching RRB key (pull)"""
1216 ssid = "test-ft"
1217 passphrase="12345678"
1218
1219 radius = hostapd.radius_params()
1220 params = ft_params1(ssid=ssid, passphrase=passphrase)
1221 params["pmk_r1_push"] = "0"
1222 params['wpa_key_mgmt'] = "FT-EAP"
1223 params["ieee8021x"] = "1"
35d8c254 1224 params = dict(list(radius.items()) + list(params.items()))
b098542c 1225 hapd0 = hostapd.add_ap(apdev[0], params)
150948e6
MB		 1226 params = ft_params2_incorrect_rrb_key(ssid=ssid, passphrase=passphrase)
1227 params["pmk_r1_push"] = "0"
1228 params['wpa_key_mgmt'] = "FT-EAP"
1229 params["ieee8021x"] = "1"
35d8c254 1230 params = dict(list(radius.items()) + list(params.items()))
b098542c 1231 hapd1 = hostapd.add_ap(apdev[1], params)
150948e6
MB		 1232
1233 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1234 fail_test=True, eap=True)
1235
1236def test_ap_ft_mismatching_r0kh_id_pull_eap(dev, apdev):
1237 """WPA2-EAP-FT AP over DS with mismatching R0KH-ID (pull)"""
1238 ssid = "test-ft"
1239 passphrase="12345678"
1240
1241 radius = hostapd.radius_params()
1242 params = ft_params1(ssid=ssid, passphrase=passphrase)
1243 params["pmk_r1_push"] = "0"
1244 params["nas_identifier"] = "nas0.w1.fi"
1245 params['wpa_key_mgmt'] = "FT-EAP"
1246 params["ieee8021x"] = "1"
35d8c254 1247 params = dict(list(radius.items()) + list(params.items()))
b098542c 1248 hostapd.add_ap(apdev[0], params)
150948e6
MB		 1249 dev[0].connect(ssid, key_mgmt="FT-EAP", proto="WPA2", ieee80211w="1",
1250 eap="GPSK", identity="gpsk user",
1251 password="abcdefghijklmnop0123456789abcdef",
1252 scan_freq="2412")
1253
1254 params = ft_params2(ssid=ssid, passphrase=passphrase)
1255 params["pmk_r1_push"] = "0"
1256 params['wpa_key_mgmt'] = "FT-EAP"
1257 params["ieee8021x"] = "1"
35d8c254 1258 params = dict(list(radius.items()) + list(params.items()))
b098542c 1259 hostapd.add_ap(apdev[1], params)
150948e6
MB		 1260
1261 dev[0].scan_for_bss(apdev[1]['bssid'], freq="2412")
1262 dev[0].roam_over_ds(apdev[1]['bssid'], fail_test=True)
1263
1264def test_ap_ft_mismatching_rrb_r0kh_push_eap(dev, apdev):
1265 """WPA2-EAP-FT AP over DS with mismatching R0KH key (push)"""
1266 ssid = "test-ft"
1267 passphrase="12345678"
1268
1269 radius = hostapd.radius_params()
1270 params = ft_params1(ssid=ssid, passphrase=passphrase)
58be42b2 1271 params["ieee80211w"] = "2"
150948e6
MB		 1272 params['wpa_key_mgmt'] = "FT-EAP"
1273 params["ieee8021x"] = "1"
35d8c254 1274 params = dict(list(radius.items()) + list(params.items()))
b098542c 1275 hapd0 = hostapd.add_ap(apdev[0], params)
150948e6 1276 params = ft_params2_r0kh_mismatch(ssid=ssid, passphrase=passphrase)
58be42b2 1277 params["ieee80211w"] = "2"
150948e6
MB		 1278 params['wpa_key_mgmt'] = "FT-EAP"
1279 params["ieee8021x"] = "1"
35d8c254 1280 params = dict(list(radius.items()) + list(params.items()))
b098542c 1281 hapd1 = hostapd.add_ap(apdev[1], params)
150948e6
MB		 1282
1283 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1284 fail_test=True, eap=True)
1285
1286def test_ap_ft_mismatching_rrb_r0kh_pull_eap(dev, apdev):
1287 """WPA2-EAP-FT AP over DS with mismatching R0KH key (pull)"""
1288 ssid = "test-ft"
1289 passphrase="12345678"
1290
1291 radius = hostapd.radius_params()
1292 params = ft_params1_r0kh_mismatch(ssid=ssid, passphrase=passphrase)
1293 params["pmk_r1_push"] = "0"
1294 params['wpa_key_mgmt'] = "FT-EAP"
1295 params["ieee8021x"] = "1"
35d8c254 1296 params = dict(list(radius.items()) + list(params.items()))
b098542c 1297 hapd0 = hostapd.add_ap(apdev[0], params)
150948e6
MB		 1298 params = ft_params2(ssid=ssid, passphrase=passphrase)
1299 params["pmk_r1_push"] = "0"
1300 params['wpa_key_mgmt'] = "FT-EAP"
1301 params["ieee8021x"] = "1"
35d8c254 1302 params = dict(list(radius.items()) + list(params.items()))
b098542c 1303 hapd1 = hostapd.add_ap(apdev[1], params)
150948e6
MB		 1304
1305 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
1306 fail_test=True, eap=True)
1307
c6b6e105
JM		 1308def test_ap_ft_gtk_rekey(dev, apdev):
1309 """WPA2-PSK-FT AP and GTK rekey"""
1310 ssid = "test-ft"
1311 passphrase="12345678"
1312
1313 params = ft_params1(ssid=ssid, passphrase=passphrase)
1314 params['wpa_group_rekey'] = '1'
8b8a1864 1315 hapd = hostapd.add_ap(apdev[0], params)
c6b6e105
JM		 1316
1317 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2f816c21 1318 ieee80211w="1", scan_freq="2412")
c6b6e105
JM		 1319
1320 ev = dev[0].wait_event(["WPA: Group rekeying completed"], timeout=2)
1321 if ev is None:
1322 raise Exception("GTK rekey timed out after initial association")
a8375c94 1323 hwsim_utils.test_connectivity(dev[0], hapd)
c6b6e105
JM		 1324
1325 params = ft_params2(ssid=ssid, passphrase=passphrase)
1326 params['wpa_group_rekey'] = '1'
8b8a1864 1327 hapd1 = hostapd.add_ap(apdev[1], params)
c6b6e105
JM		 1328
1329 dev[0].scan_for_bss(apdev[1]['bssid'], freq="2412")
1330 dev[0].roam(apdev[1]['bssid'])
1331 if dev[0].get_status_field('bssid') != apdev[1]['bssid']:
1332 raise Exception("Did not connect to correct AP")
a8375c94 1333 hwsim_utils.test_connectivity(dev[0], hapd1)
c6b6e105
JM		 1334
1335 ev = dev[0].wait_event(["WPA: Group rekeying completed"], timeout=2)
1336 if ev is None:
1337 raise Exception("GTK rekey timed out after FT protocol")
a8375c94 1338 hwsim_utils.test_connectivity(dev[0], hapd1)
5b3c40a6
JM		 1339
1340def test_ft_psk_key_lifetime_in_memory(dev, apdev, params):
1341 """WPA2-PSK-FT and key lifetime in memory"""
1342 ssid = "test-ft"
1343 passphrase="04c2726b4b8d5f1b4db9c07aa4d9e9d8f765cb5d25ec817e6cc4fcdd5255db0"
1344 psk = '93c90846ff67af9037ed83fb72b63dbeddaa81d47f926c20909b5886f1d9358d'
1345 pmk = binascii.unhexlify(psk)
1346 p = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 1347 hapd0 = hostapd.add_ap(apdev[0], p)
5b3c40a6 1348 p = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 1349 hapd1 = hostapd.add_ap(apdev[1], p)
5b3c40a6
JM		 1350
1351 pid = find_wpas_process(dev[0])
1352
1353 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1354 scan_freq="2412")
8e416cec
JM		 1355 # The decrypted copy of GTK is freed only after the CTRL-EVENT-CONNECTED
1356 # event has been delivered, so verify that wpa_supplicant has returned to
1357 # eloop before reading process memory.
54f2cae2 1358 time.sleep(1)
8e416cec 1359 dev[0].ping()
5b3c40a6
JM		 1360
1361 buf = read_process_memory(pid, pmk)
1362
1363 dev[0].request("DISCONNECT")
1364 dev[0].wait_disconnected()
1365
1366 dev[0].relog()
1367 pmkr0 = None
1368 pmkr1 = None
1369 ptk = None
1370 gtk = None
1371 with open(os.path.join(params['logdir'], 'log0'), 'r') as f:
1372 for l in f.readlines():
1373 if "FT: PMK-R0 - hexdump" in l:
1374 val = l.strip().split(':')[3].replace(' ', '')
1375 pmkr0 = binascii.unhexlify(val)
1376 if "FT: PMK-R1 - hexdump" in l:
1377 val = l.strip().split(':')[3].replace(' ', '')
1378 pmkr1 = binascii.unhexlify(val)
f918b95b 1379 if "FT: KCK - hexdump" in l:
5b3c40a6 1380 val = l.strip().split(':')[3].replace(' ', '')
f918b95b
JM		 1381 kck = binascii.unhexlify(val)
1382 if "FT: KEK - hexdump" in l:
1383 val = l.strip().split(':')[3].replace(' ', '')
1384 kek = binascii.unhexlify(val)
1385 if "FT: TK - hexdump" in l:
1386 val = l.strip().split(':')[3].replace(' ', '')
1387 tk = binascii.unhexlify(val)
5b3c40a6
JM		 1388 if "WPA: Group Key - hexdump" in l:
1389 val = l.strip().split(':')[3].replace(' ', '')
1390 gtk = binascii.unhexlify(val)
f918b95b 1391 if not pmkr0 or not pmkr1 or not kck or not kek or not tk or not gtk:
5b3c40a6
JM		 1392 raise Exception("Could not find keys from debug log")
1393 if len(gtk) != 16:
1394 raise Exception("Unexpected GTK length")
1395
5b3c40a6
JM		 1396 logger.info("Checking keys in memory while associated")
1397 get_key_locations(buf, pmk, "PMK")
1398 get_key_locations(buf, pmkr0, "PMK-R0")
1399 get_key_locations(buf, pmkr1, "PMK-R1")
1400 if pmk not in buf:
81e787b7 1401 raise HwsimSkip("PMK not found while associated")
5b3c40a6 1402 if pmkr0 not in buf:
81e787b7 1403 raise HwsimSkip("PMK-R0 not found while associated")
5b3c40a6 1404 if pmkr1 not in buf:
81e787b7 1405 raise HwsimSkip("PMK-R1 not found while associated")
5b3c40a6
JM		 1406 if kck not in buf:
1407 raise Exception("KCK not found while associated")
1408 if kek not in buf:
1409 raise Exception("KEK not found while associated")
b74f82a4
JM		 1410 #if tk in buf:
1411 # raise Exception("TK found from memory")
5b3c40a6
JM		 1412
1413 logger.info("Checking keys in memory after disassociation")
1414 buf = read_process_memory(pid, pmk)
1415 get_key_locations(buf, pmk, "PMK")
1416 get_key_locations(buf, pmkr0, "PMK-R0")
1417 get_key_locations(buf, pmkr1, "PMK-R1")
1418
1419 # Note: PMK/PSK is still present in network configuration
1420
1421 fname = os.path.join(params['logdir'],
1422 'ft_psk_key_lifetime_in_memory.memctx-')
1423 verify_not_present(buf, pmkr0, fname, "PMK-R0")
1424 verify_not_present(buf, pmkr1, fname, "PMK-R1")
1425 verify_not_present(buf, kck, fname, "KCK")
1426 verify_not_present(buf, kek, fname, "KEK")
1427 verify_not_present(buf, tk, fname, "TK")
6db556b2
JM		 1428 if gtk in buf:
1429 get_key_locations(buf, gtk, "GTK")
5b3c40a6
JM		 1430 verify_not_present(buf, gtk, fname, "GTK")
1431
1432 dev[0].request("REMOVE_NETWORK all")
1433
1434 logger.info("Checking keys in memory after network profile removal")
1435 buf = read_process_memory(pid, pmk)
1436 get_key_locations(buf, pmk, "PMK")
1437 get_key_locations(buf, pmkr0, "PMK-R0")
1438 get_key_locations(buf, pmkr1, "PMK-R1")
1439
1440 verify_not_present(buf, pmk, fname, "PMK")
1441 verify_not_present(buf, pmkr0, fname, "PMK-R0")
1442 verify_not_present(buf, pmkr1, fname, "PMK-R1")
1443 verify_not_present(buf, kck, fname, "KCK")
1444 verify_not_present(buf, kek, fname, "KEK")
1445 verify_not_present(buf, tk, fname, "TK")
1446 verify_not_present(buf, gtk, fname, "GTK")
664093b5 1447
9fd6804d 1448@remote_compatible
664093b5
JM		 1449def test_ap_ft_invalid_resp(dev, apdev):
1450 """WPA2-PSK-FT AP and invalid response IEs"""
1451 ssid = "test-ft"
1452 passphrase="12345678"
1453
1454 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 1455 hapd0 = hostapd.add_ap(apdev[0], params)
664093b5
JM		 1456 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1457 scan_freq="2412")
1458
1459 params = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 1460 hapd1 = hostapd.add_ap(apdev[1], params)
664093b5
JM		 1461
1462 tests = [
1463 # Various IEs for test coverage. The last one is FTIE with invalid
1464 # R1KH-ID subelement.
1465 "020002000000" + "3800" + "38051122334455" + "3754000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010100",
1466 # FTIE with invalid R0KH-ID subelement (len=0).
1467 "020002000000" + "3754000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010300",
1468 # FTIE with invalid R0KH-ID subelement (len=49).
1469 "020002000000" + "378500010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001033101020304050607080910111213141516171819202122232425262728293031323334353637383940414243444546474849",
1470 # Invalid RSNE.
1471 "020002000000" + "3000",
1472 # Required IEs missing from protected IE count.
1473 "020002000000" + "3603a1b201" + "375200010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001" + "3900",
1474 # RIC missing from protected IE count.
1475 "020002000000" + "3603a1b201" + "375200020203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001" + "3900",
1476 # Protected IE missing.
1477 "020002000000" + "3603a1b201" + "375200ff0203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001020304050607080900010203040506070809000102030405060708090001" + "3900" + "0000" ]
1478 for t in tests:
1479 dev[0].scan_for_bss(apdev[1]['bssid'], freq="2412")
1480 hapd1.set("ext_mgmt_frame_handling", "1")
1481 hapd1.dump_monitor()
1482 if "OK" not in dev[0].request("ROAM " + apdev[1]['bssid']):
1483 raise Exception("ROAM failed")
1484 auth = None
1485 for i in range(20):
1486 msg = hapd1.mgmt_rx()
1487 if msg['subtype'] == 11:
1488 auth = msg
1489 break
1490 if not auth:
1491 raise Exception("Authentication frame not seen")
1492
1493 resp = {}
1494 resp['fc'] = auth['fc']
1495 resp['da'] = auth['sa']
1496 resp['sa'] = auth['da']
1497 resp['bssid'] = auth['bssid']
1498 resp['payload'] = binascii.unhexlify(t)
1499 hapd1.mgmt_tx(resp)
1500 hapd1.set("ext_mgmt_frame_handling", "0")
1501 dev[0].wait_disconnected()
1502
1503 dev[0].request("RECONNECT")
1504 dev[0].wait_connected()
7b741a53
JM		 1505
1506def test_ap_ft_gcmp_256(dev, apdev):
1507 """WPA2-PSK-FT AP with GCMP-256 cipher"""
1508 if "GCMP-256" not in dev[0].get_capability("pairwise"):
1509 raise HwsimSkip("Cipher GCMP-256 not supported")
1510 ssid = "test-ft"
1511 passphrase="12345678"
1512
1513 params = ft_params1(ssid=ssid, passphrase=passphrase)
1514 params['rsn_pairwise'] = "GCMP-256"
8b8a1864 1515 hapd0 = hostapd.add_ap(apdev[0], params)
7b741a53
JM		 1516 params = ft_params2(ssid=ssid, passphrase=passphrase)
1517 params['rsn_pairwise'] = "GCMP-256"
8b8a1864 1518 hapd1 = hostapd.add_ap(apdev[1], params)
7b741a53
JM		 1519
1520 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase,
1521 pairwise_cipher="GCMP-256", group_cipher="GCMP-256")
cf671d54 1522
63a7683b 1523def setup_ap_ft_oom(dev, apdev):
38934ed1 1524 skip_with_fips(dev[0])
cf671d54
JM		 1525 ssid = "test-ft"
1526 passphrase="12345678"
1527
1528 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 1529 hapd0 = hostapd.add_ap(apdev[0], params)
cf671d54 1530 params = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 1531 hapd1 = hostapd.add_ap(apdev[1], params)
cf671d54
JM		 1532
1533 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1534 scan_freq="2412")
1535 if dev[0].get_status_field('bssid') == apdev[0]['bssid']:
1536 dst = apdev[1]['bssid']
1537 else:
1538 dst = apdev[0]['bssid']
1539
1540 dev[0].scan_for_bss(dst, freq="2412")
63a7683b
JM		 1541
1542 return dst
1543
1544def test_ap_ft_oom(dev, apdev):
1545 """WPA2-PSK-FT and OOM"""
1546 dst = setup_ap_ft_oom(dev, apdev)
cf671d54
JM		 1547 with alloc_fail(dev[0], 1, "wpa_ft_gen_req_ies"):
1548 dev[0].roam(dst)
63a7683b
JM		 1549
1550def test_ap_ft_oom2(dev, apdev):
1551 """WPA2-PSK-FT and OOM (2)"""
1552 dst = setup_ap_ft_oom(dev, apdev)
7cbc8e67 1553 with fail_test(dev[0], 1, "wpa_ft_mic"):
63a7683b
JM		 1554 dev[0].roam(dst, fail_test=True, assoc_reject_ok=True)
1555
1556def test_ap_ft_oom3(dev, apdev):
1557 """WPA2-PSK-FT and OOM (3)"""
1558 dst = setup_ap_ft_oom(dev, apdev)
cf671d54 1559 with fail_test(dev[0], 1, "os_get_random;wpa_ft_prepare_auth_request"):
63a7683b 1560 dev[0].roam(dst)
34d3eaa8 1561
63a7683b
JM		 1562def test_ap_ft_oom4(dev, apdev):
1563 """WPA2-PSK-FT and OOM (4)"""
1564 ssid = "test-ft"
1565 passphrase="12345678"
1566 dst = setup_ap_ft_oom(dev, apdev)
dcbb5d80
JM		 1567 dev[0].request("REMOVE_NETWORK all")
1568 with alloc_fail(dev[0], 1, "=sme_update_ft_ies"):
1569 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1570 scan_freq="2412")
1571
682a79f0
JM		 1572def test_ap_ft_ap_oom(dev, apdev):
1573 """WPA2-PSK-FT and AP OOM"""
1574 ssid = "test-ft"
1575 passphrase="12345678"
1576
1577 params = ft_params1(ssid=ssid, passphrase=passphrase)
1578 hapd0 = hostapd.add_ap(apdev[0], params)
1579 bssid0 = hapd0.own_addr()
1580
1581 dev[0].scan_for_bss(bssid0, freq="2412")
1582 with alloc_fail(hapd0, 1, "wpa_ft_store_pmk_r0"):
1583 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1584 scan_freq="2412")
1585
1586 params = ft_params2(ssid=ssid, passphrase=passphrase)
1587 hapd1 = hostapd.add_ap(apdev[1], params)
1588 bssid1 = hapd1.own_addr()
1589 dev[0].scan_for_bss(bssid1, freq="2412")
1590 # This roam will fail due to missing PMK-R0 (OOM prevented storing it)
1591 dev[0].roam(bssid1)
1592
1593def test_ap_ft_ap_oom2(dev, apdev):
1594 """WPA2-PSK-FT and AP OOM 2"""
1595 ssid = "test-ft"
1596 passphrase="12345678"
1597
1598 params = ft_params1(ssid=ssid, passphrase=passphrase)
1599 hapd0 = hostapd.add_ap(apdev[0], params)
1600 bssid0 = hapd0.own_addr()
1601
1602 dev[0].scan_for_bss(bssid0, freq="2412")
1603 with alloc_fail(hapd0, 1, "wpa_ft_store_pmk_r1"):
1604 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1605 scan_freq="2412")
1606
1607 params = ft_params2(ssid=ssid, passphrase=passphrase)
1608 hapd1 = hostapd.add_ap(apdev[1], params)
1609 bssid1 = hapd1.own_addr()
1610 dev[0].scan_for_bss(bssid1, freq="2412")
1611 dev[0].roam(bssid1)
1612 if dev[0].get_status_field('bssid') != bssid1:
1613 raise Exception("Did not roam to AP1")
1614 # This roam will fail due to missing PMK-R1 (OOM prevented storing it)
1615 dev[0].roam(bssid0)
1616
1617def test_ap_ft_ap_oom3(dev, apdev):
1618 """WPA2-PSK-FT and AP OOM 3"""
1619 ssid = "test-ft"
1620 passphrase="12345678"
1621
1622 params = ft_params1(ssid=ssid, passphrase=passphrase)
1623 hapd0 = hostapd.add_ap(apdev[0], params)
1624 bssid0 = hapd0.own_addr()
1625
1626 dev[0].scan_for_bss(bssid0, freq="2412")
1627 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1628 scan_freq="2412")
1629
1630 params = ft_params2(ssid=ssid, passphrase=passphrase)
1631 hapd1 = hostapd.add_ap(apdev[1], params)
1632 bssid1 = hapd1.own_addr()
1633 dev[0].scan_for_bss(bssid1, freq="2412")
1634 with alloc_fail(hapd1, 1, "wpa_ft_pull_pmk_r1"):
1635 # This will fail due to not being able to send out PMK-R1 pull request
1636 dev[0].roam(bssid1)
1637
ba88dd65 1638 with fail_test(hapd1, 2, "os_get_random;wpa_ft_pull_pmk_r1"):
682a79f0
JM		 1639 # This will fail due to not being able to send out PMK-R1 pull request
1640 dev[0].roam(bssid1)
1641
ba88dd65
MB		 1642 with fail_test(hapd1, 2, "aes_siv_encrypt;wpa_ft_pull_pmk_r1"):
1643 # This will fail due to not being able to send out PMK-R1 pull request
1644 dev[0].roam(bssid1)
1645
1646def test_ap_ft_ap_oom3b(dev, apdev):
1647 """WPA2-PSK-FT and AP OOM 3b"""
1648 ssid = "test-ft"
1649 passphrase="12345678"
1650
1651 params = ft_params1(ssid=ssid, passphrase=passphrase)
1652 hapd0 = hostapd.add_ap(apdev[0], params)
1653 bssid0 = hapd0.own_addr()
1654
1655 dev[0].scan_for_bss(bssid0, freq="2412")
1656 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1657 scan_freq="2412")
1658
1659 params = ft_params2(ssid=ssid, passphrase=passphrase)
1660 hapd1 = hostapd.add_ap(apdev[1], params)
1661 bssid1 = hapd1.own_addr()
1662 dev[0].scan_for_bss(bssid1, freq="2412")
1663 with fail_test(hapd1, 1, "os_get_random;wpa_ft_pull_pmk_r1"):
682a79f0
JM		 1664 # This will fail due to not being able to send out PMK-R1 pull request
1665 dev[0].roam(bssid1)
1666
1667def test_ap_ft_ap_oom4(dev, apdev):
1668 """WPA2-PSK-FT and AP OOM 4"""
1669 ssid = "test-ft"
1670 passphrase="12345678"
1671
1672 params = ft_params1(ssid=ssid, passphrase=passphrase)
1673 hapd0 = hostapd.add_ap(apdev[0], params)
1674 bssid0 = hapd0.own_addr()
1675
1676 dev[0].scan_for_bss(bssid0, freq="2412")
1677 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1678 scan_freq="2412")
1679
1680 params = ft_params2(ssid=ssid, passphrase=passphrase)
1681 hapd1 = hostapd.add_ap(apdev[1], params)
1682 bssid1 = hapd1.own_addr()
1683 dev[0].scan_for_bss(bssid1, freq="2412")
1684 with alloc_fail(hapd1, 1, "wpa_ft_gtk_subelem"):
1685 dev[0].roam(bssid1)
1686 if dev[0].get_status_field('bssid') != bssid1:
1687 raise Exception("Did not roam to AP1")
1688
1689 with fail_test(hapd0, 1, "wpa_auth_get_seqnum;wpa_ft_gtk_subelem"):
1690 dev[0].roam(bssid0)
1691 if dev[0].get_status_field('bssid') != bssid0:
1692 raise Exception("Did not roam to AP0")
1693
1694 with fail_test(hapd0, 1, "aes_wrap;wpa_ft_gtk_subelem"):
1695 dev[0].roam(bssid1)
1696 if dev[0].get_status_field('bssid') != bssid1:
1697 raise Exception("Did not roam to AP1")
1698
1699def test_ap_ft_ap_oom5(dev, apdev):
1700 """WPA2-PSK-FT and AP OOM 5"""
1701 ssid = "test-ft"
1702 passphrase="12345678"
1703
1704 params = ft_params1(ssid=ssid, passphrase=passphrase)
1705 hapd0 = hostapd.add_ap(apdev[0], params)
1706 bssid0 = hapd0.own_addr()
1707
1708 dev[0].scan_for_bss(bssid0, freq="2412")
1709 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1710 scan_freq="2412")
1711
1712 params = ft_params2(ssid=ssid, passphrase=passphrase)
1713 hapd1 = hostapd.add_ap(apdev[1], params)
1714 bssid1 = hapd1.own_addr()
1715 dev[0].scan_for_bss(bssid1, freq="2412")
1716 with alloc_fail(hapd1, 1, "=wpa_ft_process_auth_req"):
1717 # This will fail to roam
1718 dev[0].roam(bssid1)
1719
1720 with fail_test(hapd1, 1, "os_get_random;wpa_ft_process_auth_req"):
1721 # This will fail to roam
1722 dev[0].roam(bssid1)
1723
1724 with fail_test(hapd1, 1, "sha256_prf_bits;wpa_pmk_r1_to_ptk;wpa_ft_process_auth_req"):
1725 # This will fail to roam
1726 dev[0].roam(bssid1)
1727
1728 with fail_test(hapd1, 3, "wpa_pmk_r1_to_ptk;wpa_ft_process_auth_req"):
1729 # This will fail to roam
1730 dev[0].roam(bssid1)
1731
1732 with fail_test(hapd1, 1, "wpa_derive_pmk_r1_name;wpa_ft_process_auth_req"):
1733 # This will fail to roam
1734 dev[0].roam(bssid1)
1735
1736def test_ap_ft_ap_oom6(dev, apdev):
1737 """WPA2-PSK-FT and AP OOM 6"""
1738 ssid = "test-ft"
1739 passphrase="12345678"
1740
1741 params = ft_params1(ssid=ssid, passphrase=passphrase)
1742 hapd0 = hostapd.add_ap(apdev[0], params)
1743 bssid0 = hapd0.own_addr()
1744
1745 dev[0].scan_for_bss(bssid0, freq="2412")
1746 with fail_test(hapd0, 1, "wpa_derive_pmk_r0;wpa_auth_derive_ptk_ft"):
1747 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1748 scan_freq="2412")
1749 dev[0].request("REMOVE_NETWORK all")
1750 dev[0].wait_disconnected()
1751 with fail_test(hapd0, 1, "wpa_derive_pmk_r1;wpa_auth_derive_ptk_ft"):
1752 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1753 scan_freq="2412")
1754 dev[0].request("REMOVE_NETWORK all")
1755 dev[0].wait_disconnected()
1756 with fail_test(hapd0, 1, "wpa_pmk_r1_to_ptk;wpa_auth_derive_ptk_ft"):
1757 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1758 scan_freq="2412")
1759
c5262648
JM		 1760def test_ap_ft_ap_oom7a(dev, apdev):
1761 """WPA2-PSK-FT and AP OOM 7a"""
682a79f0
JM		 1762 ssid = "test-ft"
1763 passphrase="12345678"
1764
1765 params = ft_params1(ssid=ssid, passphrase=passphrase)
1766 params["ieee80211w"] = "2"
1767 hapd0 = hostapd.add_ap(apdev[0], params)
1768 bssid0 = hapd0.own_addr()
1769
1770 dev[0].scan_for_bss(bssid0, freq="2412")
1771 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1772 ieee80211w="2", scan_freq="2412")
1773
1774 params = ft_params2(ssid=ssid, passphrase=passphrase)
1775 params["ieee80211w"] = "2"
1776 hapd1 = hostapd.add_ap(apdev[1], params)
1777 bssid1 = hapd1.own_addr()
1778 dev[0].scan_for_bss(bssid1, freq="2412")
1779 with alloc_fail(hapd1, 1, "wpa_ft_igtk_subelem"):
1780 # This will fail to roam
1781 dev[0].roam(bssid1)
c5262648
JM		 1782
1783def test_ap_ft_ap_oom7b(dev, apdev):
1784 """WPA2-PSK-FT and AP OOM 7b"""
1785 ssid = "test-ft"
1786 passphrase="12345678"
1787
1788 params = ft_params1(ssid=ssid, passphrase=passphrase)
1789 params["ieee80211w"] = "2"
1790 hapd0 = hostapd.add_ap(apdev[0], params)
1791 bssid0 = hapd0.own_addr()
1792
1793 dev[0].scan_for_bss(bssid0, freq="2412")
1794 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1795 ieee80211w="2", scan_freq="2412")
1796
1797 params = ft_params2(ssid=ssid, passphrase=passphrase)
1798 params["ieee80211w"] = "2"
1799 hapd1 = hostapd.add_ap(apdev[1], params)
1800 bssid1 = hapd1.own_addr()
1801 dev[0].scan_for_bss(bssid1, freq="2412")
682a79f0
JM		 1802 with fail_test(hapd1, 1, "aes_wrap;wpa_ft_igtk_subelem"):
1803 # This will fail to roam
1804 dev[0].roam(bssid1)
c5262648
JM		 1805
1806def test_ap_ft_ap_oom7c(dev, apdev):
1807 """WPA2-PSK-FT and AP OOM 7c"""
1808 ssid = "test-ft"
1809 passphrase="12345678"
1810
1811 params = ft_params1(ssid=ssid, passphrase=passphrase)
1812 params["ieee80211w"] = "2"
1813 hapd0 = hostapd.add_ap(apdev[0], params)
1814 bssid0 = hapd0.own_addr()
1815
1816 dev[0].scan_for_bss(bssid0, freq="2412")
1817 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1818 ieee80211w="2", scan_freq="2412")
1819
1820 params = ft_params2(ssid=ssid, passphrase=passphrase)
1821 params["ieee80211w"] = "2"
1822 hapd1 = hostapd.add_ap(apdev[1], params)
1823 bssid1 = hapd1.own_addr()
1824 dev[0].scan_for_bss(bssid1, freq="2412")
682a79f0
JM		 1825 with alloc_fail(hapd1, 1, "=wpa_sm_write_assoc_resp_ies"):
1826 # This will fail to roam
1827 dev[0].roam(bssid1)
c5262648
JM		 1828
1829def test_ap_ft_ap_oom7d(dev, apdev):
1830 """WPA2-PSK-FT and AP OOM 7d"""
1831 ssid = "test-ft"
1832 passphrase="12345678"
1833
1834 params = ft_params1(ssid=ssid, passphrase=passphrase)
1835 params["ieee80211w"] = "2"
1836 hapd0 = hostapd.add_ap(apdev[0], params)
1837 bssid0 = hapd0.own_addr()
1838
1839 dev[0].scan_for_bss(bssid0, freq="2412")
1840 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1841 ieee80211w="2", scan_freq="2412")
1842
1843 params = ft_params2(ssid=ssid, passphrase=passphrase)
1844 params["ieee80211w"] = "2"
1845 hapd1 = hostapd.add_ap(apdev[1], params)
1846 bssid1 = hapd1.own_addr()
1847 dev[0].scan_for_bss(bssid1, freq="2412")
682a79f0
JM		 1848 with fail_test(hapd1, 1, "wpa_ft_mic;wpa_sm_write_assoc_resp_ies"):
1849 # This will fail to roam
1850 dev[0].roam(bssid1)
1851
1852def test_ap_ft_ap_oom8(dev, apdev):
1853 """WPA2-PSK-FT and AP OOM 8"""
1854 ssid = "test-ft"
1855 passphrase="12345678"
1856
1857 params = ft_params1(ssid=ssid, passphrase=passphrase)
58be42b2 1858 params['ft_psk_generate_local'] = "1"
682a79f0
JM		 1859 hapd0 = hostapd.add_ap(apdev[0], params)
1860 bssid0 = hapd0.own_addr()
1861
1862 dev[0].scan_for_bss(bssid0, freq="2412")
1863 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1864 scan_freq="2412")
1865
1866 params = ft_params2(ssid=ssid, passphrase=passphrase)
58be42b2 1867 params['ft_psk_generate_local'] = "1"
682a79f0
JM		 1868 hapd1 = hostapd.add_ap(apdev[1], params)
1869 bssid1 = hapd1.own_addr()
1870 dev[0].scan_for_bss(bssid1, freq="2412")
1871 with fail_test(hapd1, 1, "wpa_derive_pmk_r0;wpa_ft_psk_pmk_r1"):
1872 # This will fail to roam
1873 dev[0].roam(bssid1)
1874 with fail_test(hapd1, 1, "wpa_derive_pmk_r1;wpa_ft_psk_pmk_r1"):
1875 # This will fail to roam
1876 dev[0].roam(bssid1)
1877
1878def test_ap_ft_ap_oom9(dev, apdev):
1879 """WPA2-PSK-FT and AP OOM 9"""
1880 ssid = "test-ft"
1881 passphrase="12345678"
1882
1883 params = ft_params1(ssid=ssid, passphrase=passphrase)
1884 hapd0 = hostapd.add_ap(apdev[0], params)
1885 bssid0 = hapd0.own_addr()
1886
1887 dev[0].scan_for_bss(bssid0, freq="2412")
1888 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1889 scan_freq="2412")
1890
1891 params = ft_params2(ssid=ssid, passphrase=passphrase)
1892 hapd1 = hostapd.add_ap(apdev[1], params)
1893 bssid1 = hapd1.own_addr()
1894 dev[0].scan_for_bss(bssid1, freq="2412")
1895
1896 with alloc_fail(hapd0, 1, "wpa_ft_action_rx"):
1897 # This will fail to roam
1898 if "OK" not in dev[0].request("FT_DS " + bssid1):
1899 raise Exception("FT_DS failed")
1900 wait_fail_trigger(hapd0, "GET_ALLOC_FAIL")
1901
1902 with alloc_fail(hapd1, 1, "wpa_ft_rrb_rx_request"):
1903 # This will fail to roam
1904 if "OK" not in dev[0].request("FT_DS " + bssid1):
1905 raise Exception("FT_DS failed")
1906 wait_fail_trigger(hapd1, "GET_ALLOC_FAIL")
1907
1908 with alloc_fail(hapd1, 1, "wpa_ft_send_rrb_auth_resp"):
1909 # This will fail to roam
1910 if "OK" not in dev[0].request("FT_DS " + bssid1):
1911 raise Exception("FT_DS failed")
1912 wait_fail_trigger(hapd1, "GET_ALLOC_FAIL")
1913
1914def test_ap_ft_ap_oom10(dev, apdev):
1915 """WPA2-PSK-FT and AP OOM 10"""
1916 ssid = "test-ft"
1917 passphrase="12345678"
1918
1919 params = ft_params1(ssid=ssid, passphrase=passphrase)
1920 hapd0 = hostapd.add_ap(apdev[0], params)
1921 bssid0 = hapd0.own_addr()
1922
1923 dev[0].scan_for_bss(bssid0, freq="2412")
1924 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1925 scan_freq="2412")
1926
1927 params = ft_params2(ssid=ssid, passphrase=passphrase)
1928 hapd1 = hostapd.add_ap(apdev[1], params)
1929 bssid1 = hapd1.own_addr()
1930 dev[0].scan_for_bss(bssid1, freq="2412")
1931
9441a227 1932 with fail_test(hapd0, 1, "aes_siv_decrypt;wpa_ft_rrb_rx_pull"):
682a79f0
JM		 1933 # This will fail to roam
1934 if "OK" not in dev[0].request("FT_DS " + bssid1):
1935 raise Exception("FT_DS failed")
1936 wait_fail_trigger(hapd0, "GET_FAIL")
1937
1938 with fail_test(hapd0, 1, "wpa_derive_pmk_r1;wpa_ft_rrb_rx_pull"):
1939 # This will fail to roam
1940 if "OK" not in dev[0].request("FT_DS " + bssid1):
1941 raise Exception("FT_DS failed")
1942 wait_fail_trigger(hapd0, "GET_FAIL")
1943
9441a227 1944 with fail_test(hapd0, 1, "aes_siv_encrypt;wpa_ft_rrb_rx_pull"):
682a79f0
JM		 1945 # This will fail to roam
1946 if "OK" not in dev[0].request("FT_DS " + bssid1):
1947 raise Exception("FT_DS failed")
1948 wait_fail_trigger(hapd0, "GET_FAIL")
1949
9441a227 1950 with fail_test(hapd1, 1, "aes_siv_decrypt;wpa_ft_rrb_rx_resp"):
682a79f0
JM		 1951 # This will fail to roam
1952 if "OK" not in dev[0].request("FT_DS " + bssid1):
1953 raise Exception("FT_DS failed")
1954 wait_fail_trigger(hapd1, "GET_FAIL")
1955
1956def test_ap_ft_ap_oom11(dev, apdev):
1957 """WPA2-PSK-FT and AP OOM 11"""
1958 ssid = "test-ft"
1959 passphrase="12345678"
1960
1961 params = ft_params1(ssid=ssid, passphrase=passphrase)
1962 hapd0 = hostapd.add_ap(apdev[0], params)
1963 bssid0 = hapd0.own_addr()
1964
1965 dev[0].scan_for_bss(bssid0, freq="2412")
1966 with fail_test(hapd0, 1, "wpa_derive_pmk_r1;wpa_ft_generate_pmk_r1"):
1967 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1968 scan_freq="2412")
1969 wait_fail_trigger(hapd0, "GET_FAIL")
1970
1971 dev[1].scan_for_bss(bssid0, freq="2412")
9441a227 1972 with fail_test(hapd0, 1, "aes_siv_encrypt;wpa_ft_generate_pmk_r1"):
682a79f0
JM		 1973 dev[1].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1974 scan_freq="2412")
1975 wait_fail_trigger(hapd0, "GET_FAIL")
1976
a04e6f3d
JM		 1977def test_ap_ft_over_ds_proto_ap(dev, apdev):
1978 """WPA2-PSK-FT AP over DS protocol testing for AP processing"""
1979 ssid = "test-ft"
1980 passphrase="12345678"
1981
1982 params = ft_params1(ssid=ssid, passphrase=passphrase)
1983 hapd0 = hostapd.add_ap(apdev[0], params)
1984 bssid0 = hapd0.own_addr()
1985 _bssid0 = bssid0.replace(':', '')
1986 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
1987 scan_freq="2412")
1988 addr = dev[0].own_addr()
1989 _addr = addr.replace(':', '')
1990
1991 params = ft_params2(ssid=ssid, passphrase=passphrase)
1992 hapd1 = hostapd.add_ap(apdev[1], params)
1993 bssid1 = hapd1.own_addr()
1994 _bssid1 = bssid1.replace(':', '')
1995
1996 hapd0.set("ext_mgmt_frame_handling", "1")
1997 hdr = "d0003a01" + _bssid0 + _addr + _bssid0 + "1000"
1998 valid = "0601" + _addr + _bssid1
1999 tests = [ "0601",
2000 "0601" + _addr,
2001 "0601" + _addr + _bssid0,
2002 "0601" + _addr + "ffffffffffff",
2003 "0601" + _bssid0 + _bssid0,
2004 valid,
2005 valid + "01",
2006 valid + "3700",
2007 valid + "3600",
2008 valid + "3603ffffff",
2009 valid + "3603a1b2ff",
2010 valid + "3603a1b2ff" + "3700",
2011 valid + "3603a1b2ff" + "37520000" + 16*"00" + 32*"00" + 32*"00",
2012 valid + "3603a1b2ff" + "37520001" + 16*"00" + 32*"00" + 32*"00",
2013 valid + "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa",
2014 valid + "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa" + "3000",
2015 valid + "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa" + "30260100000fac040100000fac040100000facff00000100a225368fe0983b5828a37a0acb37f253",
2016 valid + "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa" + "30260100000fac040100000fac030100000fac0400000100a225368fe0983b5828a37a0acb37f253",
2017 valid + "3603a1b2ff" + "37550000" + 16*"00" + 32*"00" + 32*"00" + "0301aa" + "30260100000fac040100000fac040100000fac0400000100a225368fe0983b5828a37a0acb37f253",
2018 valid + "0001" ]
2019 for t in tests:
2020 hapd0.dump_monitor()
2021 if "OK" not in hapd0.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + hdr + t):
2022 raise Exception("MGMT_RX_PROCESS failed")
2023
2024 hapd0.set("ext_mgmt_frame_handling", "0")
2025
34d3eaa8
JM		 2026def test_ap_ft_over_ds_proto(dev, apdev):
2027 """WPA2-PSK-FT AP over DS protocol testing"""
2028 ssid = "test-ft"
2029 passphrase="12345678"
2030
2031 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 2032 hapd0 = hostapd.add_ap(apdev[0], params)
34d3eaa8
JM		 2033 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2034 scan_freq="2412")
2035
2036 # FT Action Response while no FT-over-DS in progress
2037 msg = {}
2038 msg['fc'] = 13 << 4
2039 msg['da'] = dev[0].own_addr()
2040 msg['sa'] = apdev[0]['bssid']
2041 msg['bssid'] = apdev[0]['bssid']
2042 msg['payload'] = binascii.unhexlify("06020200000000000200000004000000")
2043 hapd0.mgmt_tx(msg)
2044
2045 params = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 2046 hapd1 = hostapd.add_ap(apdev[1], params)
34d3eaa8
JM		 2047 dev[0].scan_for_bss(apdev[1]['bssid'], freq="2412")
2048 hapd0.set("ext_mgmt_frame_handling", "1")
2049 hapd0.dump_monitor()
2050 dev[0].request("FT_DS " + apdev[1]['bssid'])
2051 for i in range(0, 10):
2052 req = hapd0.mgmt_rx()
2053 if req is None:
2054 raise Exception("MGMT RX wait timed out")
2055 if req['subtype'] == 13:
2056 break
2057 req = None
2058 if not req:
2059 raise Exception("FT Action frame not received")
2060
2061 # FT Action Response for unexpected Target AP
2062 msg['payload'] = binascii.unhexlify("0602020000000000" + "f20000000400" + "0000")
2063 hapd0.mgmt_tx(msg)
2064
2065 # FT Action Response without MDIE
2066 msg['payload'] = binascii.unhexlify("0602020000000000" + "020000000400" + "0000")
2067 hapd0.mgmt_tx(msg)
2068
2069 # FT Action Response without FTIE
2070 msg['payload'] = binascii.unhexlify("0602020000000000" + "020000000400" + "0000" + "3603a1b201")
2071 hapd0.mgmt_tx(msg)
2072
2073 # FT Action Response with FTIE SNonce mismatch
2074 msg['payload'] = binascii.unhexlify("0602020000000000" + "020000000400" + "0000" + "3603a1b201" + "3766000000000000000000000000000000000000c4e67ac1999bebd00ff4ae4d5dcaf87896bb060b469f7c78d49623fb395c3455ffffff6b693fe6f8d8c5dfac0a22344750775bd09437f98b238c9f87b97f790c0106000102030406030a6e6173312e77312e6669")
2075 hapd0.mgmt_tx(msg)
6f3815c0 2076
9fd6804d 2077@remote_compatible
6f3815c0
JM		 2078def test_ap_ft_rrb(dev, apdev):
2079 """WPA2-PSK-FT RRB protocol testing"""
2080 ssid = "test-ft"
2081 passphrase="12345678"
2082
2083 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 2084 hapd0 = hostapd.add_ap(apdev[0], params)
6f3815c0
JM		 2085
2086 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2087 scan_freq="2412")
2088
2089 _dst_ll = binascii.unhexlify(apdev[0]['bssid'].replace(':',''))
2090 _src_ll = binascii.unhexlify(dev[0].own_addr().replace(':',''))
15dfcb69 2091 proto = b'\x89\x0d'
6f3815c0
JM		 2092 ehdr = _dst_ll + _src_ll + proto
2093
2094 # Too short RRB frame
15dfcb69 2095 pkt = ehdr + b'\x01'
7ab74770 2096 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2097 raise Exception("DATA_TEST_FRAME failed")
2098
2099 # RRB discarded frame wikth unrecognized type
15dfcb69 2100 pkt = ehdr + b'\x02' + b'\x02' + b'\x01\x00' + _src_ll
7ab74770 2101 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2102 raise Exception("DATA_TEST_FRAME failed")
2103
2104 # RRB frame too short for action frame
15dfcb69 2105 pkt = ehdr + b'\x01' + b'\x02' + b'\x01\x00' + _src_ll
7ab74770 2106 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2107 raise Exception("DATA_TEST_FRAME failed")
2108
2109 # Too short RRB frame (not enough room for Action Frame body)
15dfcb69 2110 pkt = ehdr + b'\x01' + b'\x02' + b'\x00\x00' + _src_ll
7ab74770 2111 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2112 raise Exception("DATA_TEST_FRAME failed")
2113
2114 # Unexpected Action frame category
15dfcb69 2115 pkt = ehdr + b'\x01' + b'\x02' + b'\x0e\x00' + _src_ll + b'\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
7ab74770 2116 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2117 raise Exception("DATA_TEST_FRAME failed")
2118
2119 # Unexpected Action in RRB Request
15dfcb69 2120 pkt = ehdr + b'\x01' + b'\x00' + b'\x0e\x00' + _src_ll + b'\x06\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
7ab74770 2121 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2122 raise Exception("DATA_TEST_FRAME failed")
2123
2124 # Target AP address in RRB Request does not match with own address
15dfcb69 2125 pkt = ehdr + b'\x01' + b'\x00' + b'\x0e\x00' + _src_ll + b'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
7ab74770 2126 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2127 raise Exception("DATA_TEST_FRAME failed")
2128
2129 # Not enough room for status code in RRB Response
15dfcb69 2130 pkt = ehdr + b'\x01' + b'\x01' + b'\x0e\x00' + _src_ll + b'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
7ab74770 2131 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2132 raise Exception("DATA_TEST_FRAME failed")
2133
2134 # RRB discarded frame with unknown packet_type
15dfcb69 2135 pkt = ehdr + b'\x01' + b'\x02' + b'\x0e\x00' + _src_ll + b'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
7ab74770 2136 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2137 raise Exception("DATA_TEST_FRAME failed")
2138
2139 # RRB Response with non-zero status code; no STA match
15dfcb69 2140 pkt = ehdr + b'\x01' + b'\x01' + b'\x10\x00' + _src_ll + b'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' + b'\xff\xff'
7ab74770 2141 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2142 raise Exception("DATA_TEST_FRAME failed")
2143
2144 # RRB Response with zero status code and extra data; STA match
15dfcb69 2145 pkt = ehdr + b'\x01' + b'\x01' + b'\x11\x00' + _src_ll + b'\x06\x01' + _src_ll + b'\x00\x00\x00\x00\x00\x00' + b'\x00\x00' + b'\x00'
7ab74770 2146 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2147 raise Exception("DATA_TEST_FRAME failed")
2148
2149 # Too short PMK-R1 pull
15dfcb69 2150 pkt = ehdr + b'\x01' + b'\xc8' + b'\x0e\x00' + _src_ll + b'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
7ab74770 2151 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2152 raise Exception("DATA_TEST_FRAME failed")
2153
2154 # Too short PMK-R1 resp
15dfcb69 2155 pkt = ehdr + b'\x01' + b'\xc9' + b'\x0e\x00' + _src_ll + b'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
7ab74770 2156 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2157 raise Exception("DATA_TEST_FRAME failed")
2158
2159 # Too short PMK-R1 push
15dfcb69 2160 pkt = ehdr + b'\x01' + b'\xca' + b'\x0e\x00' + _src_ll + b'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
7ab74770 2161 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0
JM		 2162 raise Exception("DATA_TEST_FRAME failed")
2163
2164 # No matching R0KH address found for PMK-R0 pull response
15dfcb69 2165 pkt = ehdr + b'\x01' + b'\xc9' + b'\x5a\x00' + _src_ll + b'\x06\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' + 76 * b'\00'
7ab74770 2166 if "OK" not in dev[0].request("DATA_TEST_FRAME " + binascii.hexlify(pkt).decode()):
6f3815c0 2167 raise Exception("DATA_TEST_FRAME failed")
ecafa0cf 2168
9fd6804d 2169@remote_compatible
ecafa0cf
JM		 2170def test_rsn_ie_proto_ft_psk_sta(dev, apdev):
2171 """RSN element protocol testing for FT-PSK + PMF cases on STA side"""
2172 bssid = apdev[0]['bssid']
2173 ssid = "test-ft"
2174 passphrase="12345678"
2175
2176 params = ft_params1(ssid=ssid, passphrase=passphrase)
bc6e3288 2177 params["ieee80211w"] = "1"
ecafa0cf
JM		 2178 # This is the RSN element used normally by hostapd
2179 params['own_ie_override'] = '30140100000fac040100000fac040100000fac048c00' + '3603a1b201'
8b8a1864 2180 hapd = hostapd.add_ap(apdev[0], params)
ecafa0cf
JM		 2181 id = dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2182 ieee80211w="1", scan_freq="2412",
2183 pairwise="CCMP", group="CCMP")
2184
2185 tests = [ ('PMKIDCount field included',
2186 '30160100000fac040100000fac040100000fac048c000000' + '3603a1b201'),
2187 ('Extra IE before RSNE',
2188 'dd0400000000' + '30140100000fac040100000fac040100000fac048c00' + '3603a1b201'),
2189 ('PMKIDCount and Group Management Cipher suite fields included',
2190 '301a0100000fac040100000fac040100000fac048c000000000fac06' + '3603a1b201'),
2191 ('Extra octet after defined fields (future extensibility)',
2192 '301b0100000fac040100000fac040100000fac048c000000000fac0600' + '3603a1b201'),
2193 ('No RSN Capabilities field (PMF disabled in practice)',
2194 '30120100000fac040100000fac040100000fac04' + '3603a1b201') ]
2195 for txt,ie in tests:
2196 dev[0].request("DISCONNECT")
2197 dev[0].wait_disconnected()
2198 logger.info(txt)
2199 hapd.disable()
2200 hapd.set('own_ie_override', ie)
2201 hapd.enable()
2202 dev[0].request("BSS_FLUSH 0")
2203 dev[0].scan_for_bss(bssid, 2412, force_scan=True, only_new=True)
2204 dev[0].select_network(id, freq=2412)
2205 dev[0].wait_connected()
2206
2207 dev[0].request("DISCONNECT")
2208 dev[0].wait_disconnected()
2209
2210 logger.info('Invalid RSNE causing internal hostapd error')
2211 hapd.disable()
2212 hapd.set('own_ie_override', '30130100000fac040100000fac040100000fac048c' + '3603a1b201')
2213 hapd.enable()
2214 dev[0].request("BSS_FLUSH 0")
2215 dev[0].scan_for_bss(bssid, 2412, force_scan=True, only_new=True)
2216 dev[0].select_network(id, freq=2412)
2217 # hostapd fails to generate EAPOL-Key msg 3/4, so this connection cannot
2218 # complete.
2219 ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout=1)
2220 if ev is not None:
2221 raise Exception("Unexpected connection")
2222 dev[0].request("DISCONNECT")
2223
2224 logger.info('Unexpected PMKID causing internal hostapd error')
2225 hapd.disable()
2226 hapd.set('own_ie_override', '30260100000fac040100000fac040100000fac048c000100ffffffffffffffffffffffffffffffff' + '3603a1b201')
2227 hapd.enable()
2228 dev[0].request("BSS_FLUSH 0")
2229 dev[0].scan_for_bss(bssid, 2412, force_scan=True, only_new=True)
2230 dev[0].select_network(id, freq=2412)
2231 # hostapd fails to generate EAPOL-Key msg 3/4, so this connection cannot
2232 # complete.
2233 ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED"], timeout=1)
2234 if ev is not None:
2235 raise Exception("Unexpected connection")
2236 dev[0].request("DISCONNECT")
1025603b
JM		 2237
2238def test_ap_ft_ptk_rekey(dev, apdev):
2239 """WPA2-PSK-FT PTK rekeying triggered by station after roam"""
2240 ssid = "test-ft"
2241 passphrase="12345678"
2242
2243 params = ft_params1(ssid=ssid, passphrase=passphrase)
8b8a1864 2244 hapd0 = hostapd.add_ap(apdev[0], params)
1025603b 2245 params = ft_params2(ssid=ssid, passphrase=passphrase)
8b8a1864 2246 hapd1 = hostapd.add_ap(apdev[1], params)
1025603b
JM		 2247
2248 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, ptk_rekey="1")
2249
2250 ev = dev[0].wait_event(["CTRL-EVENT-DISCONNECTED",
2251 "WPA: Key negotiation completed"], timeout=5)
2252 if ev is None:
2253 raise Exception("No event received after roam")
2254 if "CTRL-EVENT-DISCONNECTED" in ev:
2255 raise Exception("Unexpected disconnection after roam")
2256
2257 if dev[0].get_status_field('bssid') == apdev[0]['bssid']:
2258 hapd = hapd0
2259 else:
2260 hapd = hapd1
2261 hwsim_utils.test_connectivity(dev[0], hapd)
2262
2263def test_ap_ft_ptk_rekey_ap(dev, apdev):
2264 """WPA2-PSK-FT PTK rekeying triggered by AP after roam"""
2265 ssid = "test-ft"
2266 passphrase="12345678"
2267
2268 params = ft_params1(ssid=ssid, passphrase=passphrase)
2269 params['wpa_ptk_rekey'] = '2'
8b8a1864 2270 hapd0 = hostapd.add_ap(apdev[0], params)
1025603b
JM		 2271 params = ft_params2(ssid=ssid, passphrase=passphrase)
2272 params['wpa_ptk_rekey'] = '2'
8b8a1864 2273 hapd1 = hostapd.add_ap(apdev[1], params)
1025603b
JM		 2274
2275 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase)
2276
2277 ev = dev[0].wait_event(["CTRL-EVENT-DISCONNECTED",
2278 "WPA: Key negotiation completed"], timeout=5)
2279 if ev is None:
2280 raise Exception("No event received after roam")
2281 if "CTRL-EVENT-DISCONNECTED" in ev:
2282 raise Exception("Unexpected disconnection after roam")
2283
2284 if dev[0].get_status_field('bssid') == apdev[0]['bssid']:
2285 hapd = hapd0
2286 else:
2287 hapd = hapd1
2288 hwsim_utils.test_connectivity(dev[0], hapd)
186ca473
MB		 2289
2290def test_ap_ft_internal_rrb_check(dev, apdev):
2291 """RRB internal delivery only to WPA enabled BSS"""
2292 ssid = "test-ft"
2293 passphrase="12345678"
2294
2295 radius = hostapd.radius_params()
2296 params = ft_params1(ssid=ssid, passphrase=passphrase)
2297 params['wpa_key_mgmt'] = "FT-EAP"
2298 params["ieee8021x"] = "1"
35d8c254 2299 params = dict(list(radius.items()) + list(params.items()))
8b8a1864 2300 hapd = hostapd.add_ap(apdev[0], params)
186ca473
MB		 2301 key_mgmt = hapd.get_config()['key_mgmt']
2302 if key_mgmt.split(' ')[0] != "FT-EAP":
2303 raise Exception("Unexpected GET_CONFIG(key_mgmt): " + key_mgmt)
2304
8b8a1864 2305 hapd1 = hostapd.add_ap(apdev[1], { "ssid" : ssid })
186ca473
MB		 2306
2307 # Connect to WPA enabled AP
2308 dev[0].connect(ssid, key_mgmt="FT-EAP", proto="WPA2", ieee80211w="1",
2309 eap="GPSK", identity="gpsk user",
2310 password="abcdefghijklmnop0123456789abcdef",
2311 scan_freq="2412")
2312
2313 # Try over_ds roaming to non-WPA-enabled AP.
2314 # If hostapd does not check hapd->wpa_auth internally, it will crash now.
2315 dev[0].roam_over_ds(apdev[1]['bssid'], fail_test=True)
c85fcff2
JM		 2316
2317def test_ap_ft_extra_ie(dev, apdev):
2318 """WPA2-PSK-FT AP with WPA2-PSK enabled and unexpected MDE"""
2319 ssid = "test-ft"
2320 passphrase="12345678"
2321
2322 params = ft_params1(ssid=ssid, passphrase=passphrase)
2323 params["wpa_key_mgmt"] = "WPA-PSK FT-PSK"
2324 hapd0 = hostapd.add_ap(apdev[0], params)
2325 dev[1].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2326 scan_freq="2412")
2327 dev[2].connect(ssid, psk=passphrase, key_mgmt="WPA-PSK", proto="WPA2",
2328 scan_freq="2412")
2329 try:
2330 # Add Mobility Domain element to test AP validation code.
2331 dev[0].request("VENDOR_ELEM_ADD 13 3603a1b201")
2332 dev[0].connect(ssid, psk=passphrase, key_mgmt="WPA-PSK", proto="WPA2",
2333 scan_freq="2412", wait_connect=False)
2334 ev = dev[0].wait_event(["CTRL-EVENT-CONNECTED",
2335 "CTRL-EVENT-ASSOC-REJECT"], timeout=10)
2336 if ev is None:
2337 raise Exception("No connection result")
2338 if "CTRL-EVENT-CONNECTED" in ev:
2339 raise Exception("Non-FT association accepted with MDE")
2340 if "status_code=43" not in ev:
2341 raise Exception("Unexpected status code: " + ev)
2342 dev[0].request("DISCONNECT")
2343 finally:
2344 dev[0].request("VENDOR_ELEM_REMOVE 13 *")
fd7205fa
JM		 2345
2346def test_ap_ft_ric(dev, apdev):
2347 """WPA2-PSK-FT AP and RIC"""
2348 ssid = "test-ft"
2349 passphrase="12345678"
2350
2351 params = ft_params1(ssid=ssid, passphrase=passphrase)
2352 hapd0 = hostapd.add_ap(apdev[0], params)
2353 params = ft_params2(ssid=ssid, passphrase=passphrase)
2354 hapd1 = hostapd.add_ap(apdev[1], params)
2355
2356 dev[0].set("ric_ies", "")
2357 dev[0].set("ric_ies", '""')
2358 if "FAIL" not in dev[0].request("SET ric_ies q"):
2359 raise Exception("Invalid ric_ies value accepted")
2360
2361 tests = [ "3900",
2362 "3900ff04eeeeeeee",
2363 "390400000000",
2364 "390400000000" + "390400000000",
2365 "390400000000" + "dd050050f20202",
2366 "390400000000" + "dd3d0050f2020201" + 55*"00",
2367 "390400000000" + "dd3d0050f2020201aa300010270000000000000000000000000000000000000000000000000000ffffff7f00000000000000000000000040420f00ffff0000",
2368 "390401010000" + "dd3d0050f2020201aa3000dc050000000000000000000000000000000000000000000000000000dc050000000000000000000000000000808d5b0028230000" ]
2369 for t in tests:
2370 dev[0].set("ric_ies", t)
2371 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase,
2372 test_connectivity=False)
2373 dev[0].request("REMOVE_NETWORK all")
2374 dev[0].wait_disconnected()
2375 dev[0].dump_monitor()
c8942286
JM		 2376
2377def ie_hex(ies, id):
7ab74770 2378 return binascii.hexlify(struct.pack('BB', id, len(ies[id])) + ies[id]).decode()
c8942286
JM		 2379
2380def test_ap_ft_reassoc_proto(dev, apdev):
2381 """WPA2-PSK-FT AP Reassociation Request frame parsing"""
2382 ssid = "test-ft"
2383 passphrase="12345678"
2384
2385 params = ft_params1(ssid=ssid, passphrase=passphrase)
2386 hapd0 = hostapd.add_ap(apdev[0], params)
2387 params = ft_params2(ssid=ssid, passphrase=passphrase)
2388 hapd1 = hostapd.add_ap(apdev[1], params)
2389
2390 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2391 ieee80211w="1", scan_freq="2412")
2392 if dev[0].get_status_field('bssid') == hapd0.own_addr():
2393 hapd1ap = hapd0
2394 hapd2ap = hapd1
2395 else:
2396 hapd1ap = hapd1
2397 hapd2ap = hapd0
2398
2399 dev[0].scan_for_bss(hapd2ap.own_addr(), freq="2412")
2400 hapd2ap.set("ext_mgmt_frame_handling", "1")
2401 dev[0].request("ROAM " + hapd2ap.own_addr())
2402
2403 while True:
2404 req = hapd2ap.mgmt_rx()
7ab74770 2405 hapd2ap.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + binascii.hexlify(req['frame']).decode())
c8942286
JM		 2406 if req['subtype'] == 11:
2407 break
2408
2409 while True:
2410 req = hapd2ap.mgmt_rx()
2411 if req['subtype'] == 2:
2412 break
7ab74770 2413 hapd2ap.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + binascii.hexlify(req['frame']).decode())
c8942286
JM		 2414
2415 # IEEE 802.11 header + fixed fields before IEs
7ab74770 2416 hdr = binascii.hexlify(req['frame'][0:34]).decode()
c8942286
JM		 2417 ies = parse_ie(binascii.hexlify(req['frame'][34:]))
2418 # First elements: SSID, Supported Rates, Extended Supported Rates
2419 ies1 = ie_hex(ies, 0) + ie_hex(ies, 1) + ie_hex(ies, 50)
2420
2421 rsne = ie_hex(ies, 48)
2422 mde = ie_hex(ies, 54)
2423 fte = ie_hex(ies, 55)
2424 tests = [ ]
2425 # RSN: Trying to use FT, but MDIE not included
2426 tests += [ rsne ]
2427 # RSN: Attempted to use unknown MDIE
2428 tests += [ rsne + "3603000000" ]
2429 # Invalid RSN pairwise cipher
2430 tests += [ "30260100000fac040100000fac030100000fac040000010029208a42cd25c85aa571567dce10dae3" ]
2431 # FT: No PMKID in RSNIE
2432 tests += [ "30160100000fac040100000fac040100000fac0400000000" + ie_hex(ies, 54) ]
2433 # FT: Invalid FTIE
2434 tests += [ rsne + mde ]
2435 # FT: RIC IE(s) in the frame, but not included in protected IE count
2436 # FT: Failed to parse FT IEs
2437 tests += [ rsne + mde + fte + "3900" ]
2438 # FT: SNonce mismatch in FTIE
2439 tests += [ rsne + mde + "37520000" + 16*"00" + 32*"00" + 32*"00" ]
2440 # FT: ANonce mismatch in FTIE
2441 tests += [ rsne + mde + fte[0:40] + 32*"00" + fte[104:] ]
2442 # FT: No R0KH-ID subelem in FTIE
2443 tests += [ rsne + mde + "3752" + fte[4:168] ]
2444 # FT: R0KH-ID in FTIE did not match with the current R0KH-ID
2445 tests += [ rsne + mde + "3755" + fte[4:168] + "0301ff" ]
2446 # FT: No R1KH-ID subelem in FTIE
54c58f29 2447 tests += [ rsne + mde + "375e" + fte[4:168] + "030a" + binascii.hexlify(b"nas1.w1.fi").decode() ]
c8942286 2448 # FT: Unknown R1KH-ID used in ReassocReq
54c58f29 2449 tests += [ rsne + mde + "3766" + fte[4:168] + "030a" + binascii.hexlify(b"nas1.w1.fi").decode() + "0106000000000000" ]
c8942286
JM		 2450 # FT: PMKID in Reassoc Req did not match with the PMKR1Name derived from auth request
2451 tests += [ rsne[:-32] + 16*"00" + mde + fte ]
2452 # Invalid MIC in FTIE
2453 tests += [ rsne + mde + fte[0:8] + 16*"00" + fte[40:] ]
2454 for t in tests:
2455 hapd2ap.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + hdr + ies1 + t)
2456
2457def test_ap_ft_reassoc_local_fail(dev, apdev):
2458 """WPA2-PSK-FT AP Reassociation Request frame and local failure"""
2459 ssid = "test-ft"
2460 passphrase="12345678"
2461
2462 params = ft_params1(ssid=ssid, passphrase=passphrase)
2463 hapd0 = hostapd.add_ap(apdev[0], params)
2464 params = ft_params2(ssid=ssid, passphrase=passphrase)
2465 hapd1 = hostapd.add_ap(apdev[1], params)
2466
2467 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2468 ieee80211w="1", scan_freq="2412")
2469 if dev[0].get_status_field('bssid') == hapd0.own_addr():
2470 hapd1ap = hapd0
2471 hapd2ap = hapd1
2472 else:
2473 hapd1ap = hapd1
2474 hapd2ap = hapd0
2475
2476 dev[0].scan_for_bss(hapd2ap.own_addr(), freq="2412")
2477 # FT: Failed to calculate MIC
2478 with fail_test(hapd2ap, 1, "wpa_ft_validate_reassoc"):
2479 dev[0].request("ROAM " + hapd2ap.own_addr())
2480 ev = dev[0].wait_event(["CTRL-EVENT-ASSOC-REJECT"], timeout=10)
2481 dev[0].request("DISCONNECT")
2482 if ev is None:
2483 raise Exception("Association reject not seen")
d7f0bef9
JM		 2484
2485def test_ap_ft_reassoc_replay(dev, apdev, params):
2486 """WPA2-PSK-FT AP and replayed Reassociation Request frame"""
2487 capfile = os.path.join(params['logdir'], "hwsim0.pcapng")
2488 ssid = "test-ft"
2489 passphrase="12345678"
2490
2491 params = ft_params1(ssid=ssid, passphrase=passphrase)
2492 hapd0 = hostapd.add_ap(apdev[0], params)
2493 params = ft_params2(ssid=ssid, passphrase=passphrase)
2494 hapd1 = hostapd.add_ap(apdev[1], params)
2495
2496 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2497 scan_freq="2412")
2498 if dev[0].get_status_field('bssid') == hapd0.own_addr():
2499 hapd1ap = hapd0
2500 hapd2ap = hapd1
2501 else:
2502 hapd1ap = hapd1
2503 hapd2ap = hapd0
2504
2505 dev[0].scan_for_bss(hapd2ap.own_addr(), freq="2412")
2506 hapd2ap.set("ext_mgmt_frame_handling", "1")
2507 dev[0].dump_monitor()
2508 if "OK" not in dev[0].request("ROAM " + hapd2ap.own_addr()):
2509 raise Exception("ROAM failed")
2510
2511 reassocreq = None
2512 count = 0
2513 while count < 100:
2514 req = hapd2ap.mgmt_rx()
2515 count += 1
2516 hapd2ap.dump_monitor()
7ab74770 2517 hapd2ap.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + binascii.hexlify(req['frame']).decode())
d7f0bef9
JM		 2518 if req['subtype'] == 2:
2519 reassocreq = req
2520 ev = hapd2ap.wait_event(["MGMT-TX-STATUS"], timeout=5)
2521 if ev is None:
2522 raise Exception("No TX status seen")
2523 cmd = "MGMT_TX_STATUS_PROCESS %s" % (" ".join(ev.split(' ')[1:4]))
2524 if "OK" not in hapd2ap.request(cmd):
2525 raise Exception("MGMT_TX_STATUS_PROCESS failed")
2526 break
2527 hapd2ap.set("ext_mgmt_frame_handling", "0")
2528 if reassocreq is None:
2529 raise Exception("No Reassociation Request frame seen")
2530 dev[0].wait_connected()
2531 dev[0].dump_monitor()
2532 hapd2ap.dump_monitor()
2533
2534 hwsim_utils.test_connectivity(dev[0], hapd2ap)
2535
2536 logger.info("Replay the last Reassociation Request frame")
2537 hapd2ap.dump_monitor()
2538 hapd2ap.set("ext_mgmt_frame_handling", "1")
7ab74770 2539 hapd2ap.request("MGMT_RX_PROCESS freq=2412 datarate=0 ssi_signal=-30 frame=" + binascii.hexlify(req['frame']).decode())
d7f0bef9
JM		 2540 ev = hapd2ap.wait_event(["MGMT-TX-STATUS"], timeout=5)
2541 if ev is None:
2542 raise Exception("No TX status seen")
2543 cmd = "MGMT_TX_STATUS_PROCESS %s" % (" ".join(ev.split(' ')[1:4]))
2544 if "OK" not in hapd2ap.request(cmd):
2545 raise Exception("MGMT_TX_STATUS_PROCESS failed")
2546 hapd2ap.set("ext_mgmt_frame_handling", "0")
2547
2548 try:
2549 hwsim_utils.test_connectivity(dev[0], hapd2ap)
2550 ok = True
2551 except:
2552 ok = False
2553
2554 ap = hapd2ap.own_addr()
2555 sta = dev[0].own_addr()
2556 filt = "wlan.fc.type == 2 && " + \
2557 "wlan.da == " + sta + " && " + \
2558 "wlan.sa == " + ap
2559 fields = [ "wlan.ccmp.extiv" ]
2560 res = run_tshark(capfile, filt, fields)
2561 vals = res.splitlines()
2562 logger.info("CCMP PN: " + str(vals))
2563 if len(vals) < 2:
2564 raise Exception("Could not find all CCMP protected frames from capture")
2565 if len(set(vals)) < len(vals):
2566 raise Exception("Duplicate CCMP PN used")
2567
2568 if not ok:
2569 raise Exception("The second hwsim connectivity test failed")
0dc3c5f2
JM		 2570
2571def test_ap_ft_psk_file(dev, apdev):
2572 """WPA2-PSK-FT AP with PSK from a file"""
2573 ssid = "test-ft"
2574 passphrase="12345678"
2575
2576 params = ft_params1a(ssid=ssid, passphrase=passphrase)
2577 params['wpa_psk_file'] = 'hostapd.wpa_psk'
2578 hapd = hostapd.add_ap(apdev[0], params)
2579
2580 dev[1].connect(ssid, psk="very secret",
2581 key_mgmt="FT-PSK", proto="WPA2", ieee80211w="1",
2582 scan_freq="2412", wait_connect=False)
2583 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2584 ieee80211w="1", scan_freq="2412")
2585 dev[0].request("REMOVE_NETWORK all")
2586 dev[0].wait_disconnected()
2587 dev[0].connect(ssid, psk="very secret", key_mgmt="FT-PSK", proto="WPA2",
2588 ieee80211w="1", scan_freq="2412")
2589 dev[0].request("REMOVE_NETWORK all")
2590 dev[0].wait_disconnected()
2591 dev[0].connect(ssid, psk="secret passphrase",
2592 key_mgmt="FT-PSK", proto="WPA2", ieee80211w="1",
2593 scan_freq="2412")
2594 dev[2].connect(ssid, psk="another passphrase for all STAs",
2595 key_mgmt="FT-PSK", proto="WPA2", ieee80211w="1",
2596 scan_freq="2412")
2597 ev = dev[1].wait_event(["WPA: 4-Way Handshake failed"], timeout=10)
2598 if ev is None:
2599 raise Exception("Timed out while waiting for failure report")
2600 dev[1].request("REMOVE_NETWORK all")
62566bc2
JM		 2601
2602def test_ap_ft_eap_ap_config_change(dev, apdev):
2603 """WPA2-EAP-FT AP changing from 802.1X-only to FT-only"""
2604 ssid = "test-ft"
2605 passphrase="12345678"
2606 bssid = apdev[0]['bssid']
2607
2608 radius = hostapd.radius_params()
2609 params = ft_params1(ssid=ssid, passphrase=passphrase, discovery=True)
2610 params['wpa_key_mgmt'] = "WPA-EAP"
2611 params["ieee8021x"] = "1"
2612 params["pmk_r1_push"] = "0"
2613 params["r0kh"] = "ff:ff:ff:ff:ff:ff * 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
2614 params["r1kh"] = "00:00:00:00:00:00 00:00:00:00:00:00 00112233445566778899aabbccddeeff00112233445566778899aabbccddeeff"
2615 params["eap_server"] = "0"
35d8c254 2616 params = dict(list(radius.items()) + list(params.items()))
62566bc2
JM		 2617 hapd = hostapd.add_ap(apdev[0], params)
2618
2619 dev[0].connect(ssid, key_mgmt="FT-EAP WPA-EAP", proto="WPA2",
2620 eap="GPSK", identity="gpsk user",
2621 password="abcdefghijklmnop0123456789abcdef",
2622 scan_freq="2412")
2623 dev[0].request("DISCONNECT")
2624 dev[0].wait_disconnected()
2625 dev[0].dump_monitor()
2626
2627 hapd.disable()
2628 hapd.set('wpa_key_mgmt', "FT-EAP")
2629 hapd.enable()
2630
2631 dev[0].request("BSS_FLUSH 0")
2632 dev[0].scan_for_bss(bssid, 2412, force_scan=True, only_new=True)
2633
2634 dev[0].request("RECONNECT")
2635 dev[0].wait_connected()
55b3cda7
JM		 2636
2637def test_ap_ft_eap_sha384(dev, apdev):
2638 """WPA2-EAP-FT with SHA384"""
2639 ssid = "test-ft"
2640 passphrase="12345678"
2641
2642 radius = hostapd.radius_params()
2643 params = ft_params1(ssid=ssid, passphrase=passphrase)
58be42b2 2644 params["ieee80211w"] = "2"
55b3cda7
JM		 2645 params['wpa_key_mgmt'] = "FT-EAP-SHA384"
2646 params["ieee8021x"] = "1"
35d8c254 2647 params = dict(list(radius.items()) + list(params.items()))
55b3cda7
JM		 2648 hapd0 = hostapd.add_ap(apdev[0], params)
2649 params = ft_params2(ssid=ssid, passphrase=passphrase)
58be42b2 2650 params["ieee80211w"] = "2"
55b3cda7
JM		 2651 params['wpa_key_mgmt'] = "FT-EAP-SHA384"
2652 params["ieee8021x"] = "1"
35d8c254 2653 params = dict(list(radius.items()) + list(params.items()))
55b3cda7
JM		 2654 hapd1 = hostapd.add_ap(apdev[1], params)
2655
2656 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, eap=True,
2657 sha384=True)
2658
2659def test_ap_ft_eap_sha384_over_ds(dev, apdev):
2660 """WPA2-EAP-FT with SHA384 over DS"""
2661 ssid = "test-ft"
2662 passphrase="12345678"
2663
2664 radius = hostapd.radius_params()
2665 params = ft_params1(ssid=ssid, passphrase=passphrase)
58be42b2 2666 params["ieee80211w"] = "2"
55b3cda7
JM		 2667 params['wpa_key_mgmt'] = "FT-EAP-SHA384"
2668 params["ieee8021x"] = "1"
35d8c254 2669 params = dict(list(radius.items()) + list(params.items()))
55b3cda7
JM		 2670 hapd0 = hostapd.add_ap(apdev[0], params)
2671 params = ft_params2(ssid=ssid, passphrase=passphrase)
58be42b2 2672 params["ieee80211w"] = "2"
55b3cda7
JM		 2673 params['wpa_key_mgmt'] = "FT-EAP-SHA384"
2674 params["ieee8021x"] = "1"
35d8c254 2675 params = dict(list(radius.items()) + list(params.items()))
55b3cda7
JM		 2676 hapd1 = hostapd.add_ap(apdev[1], params)
2677
2678 run_roams(dev[0], apdev, hapd0, hapd1, ssid, passphrase, over_ds=True,
2679 eap=True, sha384=True)
392aba4e
JM		 2680
2681def test_ap_ft_roam_rrm(dev, apdev):
2682 """WPA2-PSK-FT AP and radio measurement request"""
2683 ssid = "test-ft"
2684 passphrase="12345678"
2685
2686 params = ft_params1(ssid=ssid, passphrase=passphrase)
2687 params["rrm_beacon_report"] = "1"
2688 hapd0 = hostapd.add_ap(apdev[0], params)
2689 bssid0 = hapd0.own_addr()
2690
2691 addr = dev[0].own_addr()
2692 dev[0].connect(ssid, psk=passphrase, key_mgmt="FT-PSK", proto="WPA2",
2693 scan_freq="2412")
2694 check_beacon_req(hapd0, addr, 1)
2695
2696 params = ft_params2(ssid=ssid, passphrase=passphrase)
2697 params["rrm_beacon_report"] = "1"
2698 hapd1 = hostapd.add_ap(apdev[1], params)
2699 bssid1 = hapd1.own_addr()
2700
2701 dev[0].scan_for_bss(bssid1, freq=2412)
2702 dev[0].roam(bssid1)
2703 check_beacon_req(hapd1, addr, 2)
2704
2705 dev[0].scan_for_bss(bssid0, freq=2412)
2706 dev[0].roam(bssid0)
2707 check_beacon_req(hapd0, addr, 3)
Unnamed repository; edit this file 'description' to name the repository.